Use After Free Affecting sqlite3 package, versions >=1.4.0, <2.9.6

Affected versions of this package are vulnerable to Use After Free in rb_sqlite3_aggregator_step in ext/sqlite3/aggregator.c. An attacker can make the aggregate step method receive a wrong or freed Ruby object, or crash the process, by invoking a multi-argument aggregate over attacker-controlled TEXT or BLOB values while garbage collection runs during argument conversion. The flaw affects Database#create_aggregate, #create_aggregate_handler, and Database#define_aggregator when the aggregate takes two or more arguments. Ordinary GC during conversion of a later argument can collect a Ruby object already stored for an earlier argument, so applications using such aggregates can see corrupted results or a segmentation fault.

• GitHub ChangeLog
• GitHub Commit
• Maintainer's Advisory