{"vulnerability": "cve-2022-35737", "sightings": [{"uuid": "57aa6026-9ef4-41e6-922f-30efdd14f832", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://gist.github.com/soul2zimate/a5296bc917881b1c43c396b5caf75393", "content": "", "creation_timestamp": "2026-04-07T11:43:13.000000Z"}, {"uuid": "60cfb92d-805b-44f4-acaf-a60ebecc4dff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/codeby_sec/6755", "content": "\u200b\ud83e\udeb6 \u0412 SQLite \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c 22-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Trail of Bits \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0421\u0423\u0411\u0414 SQLite, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438\u043b\u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0441\u0431\u043e\u0438 \u0432 \u0438\u0445 \u0440\u0430\u0431\u043e\u0442\u0435. \u041e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u043a\u043e\u0434 \u0435\u0449\u0435 \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2000 \u0433\u043e\u0434\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2022-35737 \u0438 \u043e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043e\u0446\u0435\u043d\u043a\u0443 \u0432 7.5 \u0431\u0430\u043b\u043b\u043e\u0432 \u0438\u0437 10 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 64-\u0431\u0438\u0442\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u0441\u0430\u043c \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u0432\u0438\u0441\u0435\u0442\u044c \u043e\u0442 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430.\n\n\u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 SQLite-\u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 printf, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0440\u0443\u0433\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0440\u043e\u043a\u0438 (sqlite3_str_vappendf). \u0410\u0442\u0430\u043a\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430, \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 \u0441\u0442\u0440\u043e\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 %Q, %q \u0438\u043b\u0438 %w.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u043b\u0430 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite \u043e\u0442 1.0.12 \u0434\u043e 3.39.1 \u0438 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441 \u0440\u0435\u043b\u0438\u0437\u043e\u043c \u0432\u0435\u0440\u0441\u0438\u0438 3.39.2, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 21 \u0438\u044e\u043b\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\ud83d\uddde \u0411\u043b\u043e\u0433 \u041a\u043e\u0434\u0435\u0431\u0430\u0439\n\n#news #sqlite #vulnerability", "creation_timestamp": "2022-10-26T15:07:28.000000Z"}, {"uuid": "476b31f4-7eaf-4ab1-b8fc-4f57d30ac645", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "published-proof-of-concept", "source": "https://t.me/MrVGunz/579", "content": "CVE-2022-35737 : SQLite 1.0.12 through 3.39.x > 3.39.2 - Array-Bounds Overflow\nBlog : https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api\nPOC : https://github.com/trailofbits/publications/tree/master/disclosures/CVE-2022-35737", "creation_timestamp": "2022-11-11T09:30:07.000000Z"}, {"uuid": "d62c9219-7dec-4984-9335-20991ed5652b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/true_secator/3617", "content": "\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 SQLite \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c 22-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0447\u0435\u043c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2022-35737 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,5) \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u043d\u0438\u0446 \u043c\u0430\u0441\u0441\u0438\u0432\u0430.\n\n\u0411\u0430\u0433\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite \u0441 1.0.12 \u043f\u043e 3.39.1.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u0435\u0440\u0442 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0410\u043d\u0434\u0440\u0435\u0430\u0441 \u041a\u0435\u043b\u043b\u0430\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e \u0431\u0430\u0433\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043e \u0432\u0440\u0435\u043c\u0435\u043d \u0434\u043e\u0442\u043a\u043e\u043c\u043e\u0432, \u0430\u0436 \u0441 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2000 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0430, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c DOS.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442 \u043f\u043e\u044f\u0441\u043d\u0438\u043b, \u0447\u0442\u043e CVE-2022-35737 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 64-\u0431\u0438\u0442\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0430.\n\n\u0415\u0441\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043d\u0435 \u0432\u043e \u0432\u0441\u0435\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445, \u0442\u043e \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u0433\u0434\u0430. \n\n\u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u0441\u0442\u0440\u043e\u043a\u043e\u0432\u044b\u0435 \u0432\u0445\u043e\u0434\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 SQLite-\u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 printf, \u0433\u0434\u0435 \u0441\u0442\u0440\u043e\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0442\u0438\u043f\u044b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 %Q, %q \u0438\u043b\u0438 %w. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u044f sqlite3_str_vappendf, \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u0430\u044f printf, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u043e\u043a\u0438.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0435\u0441\u043b\u0438 \u0441\u0442\u0440\u043e\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \"!\" \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u042e\u043d\u0438\u043a\u043e\u0434\u0430, \u0442\u043e \u0432 \u0442\u0430\u043a\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 DoS.\n\n\u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0432 \u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u044d\u0442\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u043b\u043e\u0441\u044c \u043e\u0448\u0438\u0431\u043a\u043e\u0439, \u0442\u0430\u043a \u043a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u043c\u0438 \u043f\u043e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435.\n\n\u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0431\u0430\u0433\u0443 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c 21 \u0438\u044e\u043b\u044f \u0432\u0435\u0440\u0441\u0438\u0438 3.39.2.", "creation_timestamp": "2022-10-26T11:04:02.000000Z"}, {"uuid": "2a2d40af-aef0-4f55-8867-a4b7c6d6ef5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/7050", "content": "#exploit\n1. MS SharePoint Server Post-Authentication SSRF vulnerability\nhttps://starlabs.sg/blog/2022/10-sharepoint-post-authenticated-ssrf-vulnerability\n2. Stranger Strings: An exploitable flaw in SQLite (CVE-2022-35737)\nhttps://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api\n]-> PoC Exploits: https://github.com/trailofbits/publications/tree/master/disclosures/CVE-2022-35737", "creation_timestamp": "2022-10-26T11:03:02.000000Z"}, {"uuid": "1d4d9e08-2ff4-41e4-b4aa-8c2756842742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03", "content": "", "creation_timestamp": "2026-05-21T05:00:00.000000Z"}, {"uuid": "63a9d097-bcea-45ba-8c19-79c7bc810b56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74938", "content": "Black Hat Ethical Hacking\nSQLite patches 22-year-old code execution, a DoS vulnerability\n\nSQLite patches 22-year-old code execution, a DoS vulnerabilityPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes The maintainers of the SQLite database engine have patched a high severity\u00a0vulnerability (DoS)\u00a0that attackers could exploit to crash or control programs that rely on the software.Developers of the software have offered The Daily Swig\u00a0a convincing argument that the flaw would be difficult to exploit in practice. Even so, they have revised the software with a patch to defend against the flaw \u2013 rather than dismissing the issue as something that can be safely ignored. SQLite\u00a0is a popular open source C-language library that underpins many enterprise apps and services. Notable users of SQLite\u00a0include Apple, Adobe, Google, Facebook, and Microsoft. There are billions of copies of SQLite deployed worldwide.\n\nThe SQLite team is quick to fix emerging vulnerabilities in the software due to their potentially wide-reaching impact. However, a vulnerability disclosed this month by Trail of Bits was introduced 22 years ago and highlighted how initially secure functionality could have unintended consequences much further down the line.\n\nIn a blog post\u00a0dated October 25, Trail of Bits researcher Andreas Kellas said the vulnerability was introduced in SQLite version 1.0.12, a 2000 release that landed when the software was primarily based on 32-bit architectures. According to Kellas, the bug \u201cmay not have seemed like an error\u201d at the time.\n\nThe high severity vulnerability is tracked as CVE-2022-35737, scoring a CVSS severity score of 7.5.\n\nTrail of Bits said the bug impacts any app that relies on the SQLite library API.\n\nThe vulnerability is exploitable on 64-bit systems when large string inputs contain %Q, %q, or %w\u00a0format substitution types that \u2013 in this scenario \u2013 might cause programs to crash or worse.\n\nIn the most severe cases \u2013 when the !\u00a0special character exists in the format string \u2013 it may be \u201cpossible to achieve arbitrary code execution, in the worst case, or to cause the program to hang and loop (nearly) indefinitely,\u201d according to the researchers.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Root cause analysisSpeaking to The Daily Swig, the creator of SQLite, D. Richard Hipp, said the root cause of the problem was the use of signed 32-bit integers as a byte index into the input string and to compute the size of the output string. When an input string was large enough, the integer would overflow, and \u201call kinds of problems\u201d ensued.\n\nHowever, the potential impact of the flaw appears to be limited.\n\nHipp told us that it is not possible to reach the vulnerability for malicious purposes via SQL inputs or by passing SQLite a malformed database file. Instead, an attacker would have to abuse the use the sqlite3_mprintf()\u00a0function \u2013 or \u201csimilar C-level interfaces with a format string that includes one of the non-standard [;\u2026]\u00a0conversion symbols, and then pass in a string that is over 2GB in size\u201d.\n\nThe software developer added:\n\n\u201cLots of applications use SQLite, but only a small percentage of those use the sqlite3_mprintf() API, and an even smaller percentage make use of %Q, %q, or %w. Of those that do, most do not provide a way for an attacker to arrange for a 2GB+ string to be passed into the argument to %Q, %q, or %w.\u201d\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Unearthing FossilIn addition, while the project uses the Fossil control system and this software uses printf, the team [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:19.369057Z"}, {"uuid": "0fc0da0d-5a68-4c66-a80e-6884cd5e8c92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74939", "content": "couldn\u2019t find a way to inject a 2GB string.\n\nCVE-2022-35737 was reported to the Computer Emergency Response Team (CERT) Coordination Center by Trail of Bits on July 14. CERT confirmed the issue, reached out to SQLite maintainers, and the team fixed the bug in the software\u2019s source code only three days later \u2013 a task accomplished by converting to the use of 64-bit integers.\n\nThe patched SQLite version, v3.39.2, was released on July 21.\n\n\u201cWe are grateful for the responsible disclosure from the researchers who found it,\u201d Hipp said. \u201cIt doesn\u2019t hurt to upgrade to a newer release of SQLite. But very few if any real-world applications should be affected by this.\u201d\n\n\u200b\nTrending: Exploited Windows zero-day lets JavaScript files bypass security warnings Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-1-300x150.png OpenSSL Gives Heads Up to Critical Vulnerability DisclosureOctober 31, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-1-300x150.png GitHub patches bug called repojacking that could allow access to another user\u2019s repoOctober 28, 2022\nReading Time: 3 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-1-300x150.png Windows vulnerable driver blocklist sync issue patchedOctober 27, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-2-300x150.png Cisco warns admins to patch AnyConnect flaw exploited in attacksOctober 26, 2022\nReading Time: 3 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post SQLite patches 22-year-old code execution, a DoS vulnerability first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:19.181635Z"}, {"uuid": "2f424ed0-b214-4cbb-a3b7-911352cff07c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74939", "content": "couldn\u2019t find a way to inject a 2GB string.\n\nCVE-2022-35737 was reported to the Computer Emergency Response Team (CERT) Coordination Center by Trail of Bits on July 14. CERT confirmed the issue, reached out to SQLite maintainers, and the team fixed the bug in the software\u2019s source code only three days later \u2013 a task accomplished by converting to the use of 64-bit integers.\n\nThe patched SQLite version, v3.39.2, was released on July 21.\n\n\u201cWe are grateful for the responsible disclosure from the researchers who found it,\u201d Hipp said. \u201cIt doesn\u2019t hurt to upgrade to a newer release of SQLite. But very few if any real-world applications should be affected by this.\u201d\n\n\u200b\nTrending: Exploited Windows zero-day lets JavaScript files bypass security warnings Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-1-300x150.png OpenSSL Gives Heads Up to Critical Vulnerability DisclosureOctober 31, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-1-300x150.png GitHub patches bug called repojacking that could allow access to another user\u2019s repoOctober 28, 2022\nReading Time: 3 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-1-300x150.png Windows vulnerable driver blocklist sync issue patchedOctober 27, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-2-300x150.png Cisco warns admins to patch AnyConnect flaw exploited in attacksOctober 26, 2022\nReading Time: 3 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post SQLite patches 22-year-old code execution, a DoS vulnerability first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:34.086462Z"}, {"uuid": "587fcdb3-70f7-41e9-8f61-18a0b00806c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74938", "content": "Black Hat Ethical Hacking\nSQLite patches 22-year-old code execution, a DoS vulnerability\n\nSQLite patches 22-year-old code execution, a DoS vulnerabilityPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes The maintainers of the SQLite database engine have patched a high severity\u00a0vulnerability (DoS)\u00a0that attackers could exploit to crash or control programs that rely on the software.Developers of the software have offered The Daily Swig\u00a0a convincing argument that the flaw would be difficult to exploit in practice. Even so, they have revised the software with a patch to defend against the flaw \u2013 rather than dismissing the issue as something that can be safely ignored. SQLite\u00a0is a popular open source C-language library that underpins many enterprise apps and services. Notable users of SQLite\u00a0include Apple, Adobe, Google, Facebook, and Microsoft. There are billions of copies of SQLite deployed worldwide.\n\nThe SQLite team is quick to fix emerging vulnerabilities in the software due to their potentially wide-reaching impact. However, a vulnerability disclosed this month by Trail of Bits was introduced 22 years ago and highlighted how initially secure functionality could have unintended consequences much further down the line.\n\nIn a blog post\u00a0dated October 25, Trail of Bits researcher Andreas Kellas said the vulnerability was introduced in SQLite version 1.0.12, a 2000 release that landed when the software was primarily based on 32-bit architectures. According to Kellas, the bug \u201cmay not have seemed like an error\u201d at the time.\n\nThe high severity vulnerability is tracked as CVE-2022-35737, scoring a CVSS severity score of 7.5.\n\nTrail of Bits said the bug impacts any app that relies on the SQLite library API.\n\nThe vulnerability is exploitable on 64-bit systems when large string inputs contain %Q, %q, or %w\u00a0format substitution types that \u2013 in this scenario \u2013 might cause programs to crash or worse.\n\nIn the most severe cases \u2013 when the !\u00a0special character exists in the format string \u2013 it may be \u201cpossible to achieve arbitrary code execution, in the worst case, or to cause the program to hang and loop (nearly) indefinitely,\u201d according to the researchers.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Root cause analysisSpeaking to The Daily Swig, the creator of SQLite, D. Richard Hipp, said the root cause of the problem was the use of signed 32-bit integers as a byte index into the input string and to compute the size of the output string. When an input string was large enough, the integer would overflow, and \u201call kinds of problems\u201d ensued.\n\nHowever, the potential impact of the flaw appears to be limited.\n\nHipp told us that it is not possible to reach the vulnerability for malicious purposes via SQL inputs or by passing SQLite a malformed database file. Instead, an attacker would have to abuse the use the sqlite3_mprintf()\u00a0function \u2013 or \u201csimilar C-level interfaces with a format string that includes one of the non-standard [;\u2026]\u00a0conversion symbols, and then pass in a string that is over 2GB in size\u201d.\n\nThe software developer added:\n\n\u201cLots of applications use SQLite, but only a small percentage of those use the sqlite3_mprintf() API, and an even smaller percentage make use of %Q, %q, or %w. Of those that do, most do not provide a way for an attacker to arrange for a 2GB+ string to be passed into the argument to %Q, %q, or %w.\u201d\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Unearthing FossilIn addition, while the project uses the Fossil control system and this software uses printf, the team [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:34.294572Z"}]}