CVE-2017-10989
CriticalSummary
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
Risk Assessment
Organizations may be exposed to risks associated with unauthorized memory access, potentially leading to the disclosure of sensitive data or system instability.
Recommendation
It is recommended to update SQLite to the latest version to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.