Every CVE Search/ Get API key

CVE-2023-2137

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker...

8.8 HighFix available

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.12%Up 1.0 points since Apr 19, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2023-2137
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List 8.8

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2023-2137
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2023-33657 8.8

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Record
EUVD-2023-33657
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-6653-c3g4-g7jm 8.8

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker...

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Record
GHSA-6653-c3g4-g7jm
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2023-2137 8.8

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Record
ALPINE-CVE-2023-2137
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 8.8

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2023-2137
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2023-2137 8.8

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Record
DEBIAN-CVE-2023-2137
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2024-0073 No score

Updated sqlite3 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap buffer overflow in sqlite. (CVE-2023-2137) A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. (CVE-2023-7104)

Record
MGASA-2024-0073
Updated
2026-11-02
OSVopenSUSE-SU-2023:0093-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 112.0.5615.165 (boo#1210618):

  • CVE-2023-2133: Out of bounds memory access in Service Worker API
  • CVE-2023-2134: Out of bounds memory access in Service Worker API
  • CVE-2023-2135: Use after free in DevTools
  • CVE-2023-2136: Integer overflow in Skia
  • CVE-2023-2137: Heap buffer overflow in sqlite
Record
openSUSE-SU-2023:0093-1
Updated
2026-11-02
OSVopenSUSE-SU-2023:0114-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 99.0.4788.13

    • CHR-9290 Update Chromium on desktop-stable-113-4788 to 113.0.5672.127
    • DNA-107317 __delayLoadHelper2 crash in crashreporter

  • The update to chromium 113.0.5672.127 fixes following issues: CVE-2023-2721, CVE-2023-2722, CVE-2023-2723, CVE-2023-2724, CVE-2023-2725, CVE-2023-2726

  • Update to 99.0.4788.9

    • CHR-9283 Update Chromium on desktop-stable-113-4788 to 113.0.5672.93
    • DNA-107638 Translations for O99
    • DNA-107678 Crash Report [@ BrowserContextKeyedServiceFactory:: BrowserContextKeyedServiceFactory(char const*, BrowserContextDependencyManager*) ]
    • DNA-107795 Fix wrong german translation of 'Close All Duplicate Tabs'
    • DNA-107800 Fonts on section#folder and AddSitePanel not readable when animated wallpaper chosen
    • DNA-107840 Promote O99 to stable

  • Update to 98.0.4759.39

    • DNA-102363 ChromeFileSystemAccessPermissionContextTest. ConfirmSensitiveEntryAccess_DangerousFile fails
    • DNA-105534 [Add to Opera] Incorrect scroll on modal when browser window size is too small
    • DNA-106649 Opening new tab when pinned tab is active gives 2 active tabs
    • DNA-107226 Speed Dial freezes and empty space remains after Continue booking tile dragging
    • DNA-107435 Building archive_source_release target fails
    • DNA-107441 [Start page] Right mouse click on tile in continue on section opens target site in current tab
    • DNA-107508 Crash at permissions::PermissionRecoverySuccessRate Tracker::TrackUsage(ContentSettingsType)
    • DNA-107528 Handle real-time SD impression reporting
    • DNA-107546 Context menus broken with one workspace
    • DNA-107548 Paste from Context Menu doesn’t work for Search on StartPage
    • DNA-107560 Optimize real-time SD impression reporting

  • Update to 98.0.4759.15

    • CHR-9259 Update Chromium on desktop-stable-112-4759 to 112.0.5615.121
    • CHR-9264 Update Chromium on desktop-stable-112-4759 to 112.0.5615.165
    • DNA-104949 Cleanup reauthorizer and permission
    • DNA-106748 Presubmit problems
    • DNA-107262 Delete faulty translations

  • The update to chromium 112.0.5615.165 fixes following issues: CVE-2023-2133, CVE-2023-2134, CVE-2023-2135, CVE-2023-2136, CVE-2023-2137

  • Changes in 98.0.4759.6

    • CHR-9255 Update Chromium on desktop-stable-112-4759 to 112.0.5615.87
    • DNA-106342 Crash when blocking cookies in sidebar web.infobars::InfoBarManager::AddInfoBar(std::Cr::unique_ptr, bool)
    • DNA-107054 Apply patch for CVE-2023-2033
    • DNA-107141 Promote O98 to stable
    • DNA-107142 Translations for O98

  • Update to 97.0.4719.83

    • DNA-106342 Crash when blocking cookies in sidebar web. infobars::InfoBarManager::AddInfoBar(std::Cr::unique_ptr, bool)
    • DNA-106550 [SD][Drag&Drop] Create a static manual layout for speed dials
    • DNA-106791 Run smoketests on mac arm builds
    • DNA-107054 Apply patch for CVE-2023-2033

  • Remove setup_repo.sh, fix non-executable-script rpmlint warning and we do not want create a repo

  • Update to 97.0.4719.63

    • CHR-9245 Update Chromium on desktop-stable-111-4719 to 111.0.5563.147
    • DNA-105919 Set new Baidu search string
    • DNA-106168 EasySetup update

  • Update to 97.0.4719.43

    • CHR-9236 Update Chromium on desktop-stable-111-4719 to 111.0.5563.111
    • DNA-105141 Tabs to the right of the currently active one swap their position with another when clicked
    • DNA-106044 Translations for O97
    • DNA-106300 Fix rule for generating archive_browser_sym_files on crossplatform builds
    • DNA-106412 Content of popup not generated for some extensions when using more then one worksapce
    • DNA-106433 Extend Easy Setup API
    • DNA-106435 Increase timeout for the welcome page
    • DNA-106453 Public build from desktop-stable-111-4719 do not compile

  • The update to chromium 111.0.5563.111 fixes following issues: CVE-2023-1528, CVE-2023-1529, CVE-2023-1530, CVE-2023-1531, CVE-2023-1532,…

Record
openSUSE-SU-2023:0114-1
Updated
2026-11-02
OSVopenSUSE-SU-2023:0115-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 99.0.4788.13

    • CHR-9290 Update Chromium on desktop-stable-113-4788 to 113.0.5672.127
    • DNA-107317 __delayLoadHelper2 crash in crashreporter

  • The update to chromium 113.0.5672.127 fixes following issues: CVE-2023-2721, CVE-2023-2722, CVE-2023-2723, CVE-2023-2724, CVE-2023-2725, CVE-2023-2726

  • Update to 99.0.4788.9

    • CHR-9283 Update Chromium on desktop-stable-113-4788 to 113.0.5672.93
    • DNA-107638 Translations for O99
    • DNA-107678 Crash Report [@ BrowserContextKeyedServiceFactory:: BrowserContextKeyedServiceFactory(char const*, BrowserContextDependencyManager*) ]
    • DNA-107795 Fix wrong german translation of 'Close All Duplicate Tabs'
    • DNA-107800 Fonts on section#folder and AddSitePanel not readable when animated wallpaper chosen
    • DNA-107840 Promote O99 to stable

  • Update to 98.0.4759.39

    • DNA-102363 ChromeFileSystemAccessPermissionContextTest. ConfirmSensitiveEntryAccess_DangerousFile fails
    • DNA-105534 [Add to Opera] Incorrect scroll on modal when browser window size is too small
    • DNA-106649 Opening new tab when pinned tab is active gives 2 active tabs
    • DNA-107226 Speed Dial freezes and empty space remains after Continue booking tile dragging
    • DNA-107435 Building archive_source_release target fails
    • DNA-107441 [Start page] Right mouse click on tile in continue on section opens target site in current tab
    • DNA-107508 Crash at permissions::PermissionRecoverySuccessRate Tracker::TrackUsage(ContentSettingsType)
    • DNA-107528 Handle real-time SD impression reporting
    • DNA-107546 Context menus broken with one workspace
    • DNA-107548 Paste from Context Menu doesn’t work for Search on StartPage
    • DNA-107560 Optimize real-time SD impression reporting
Record
openSUSE-SU-2023:0115-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12875-1 No score

chromedriver-112.0.5615.165-1.1 on GA media

These are all security issues fixed in the chromedriver-112.0.5615.165-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12875-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12948-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12963-1 No score

libQt5Pdf5-5.15.14-1.1 on GA media

These are all security issues fixed in the libQt5Pdf5-5.15.14-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12963-1
Updated
2026-11-02
OSVSUSE-SU-2023:4576-1 No score

Security update for sqlite3

This update for sqlite3 fixes the following issues:

  • CVE-2023-2137: Fixed heap buffer overflow (bsc#1210660).
Record
SUSE-SU-2023:4576-1
Updated
2026-11-02
OSVSUSE-SU-2023:4619-1 No score

Security update for sqlite3

This update for sqlite3 fixes the following issues:

  • CVE-2023-2137: Fixed heap buffer overflow (bsc#1210660).
Record
SUSE-SU-2023:4619-1
Updated
2026-11-02
OSVSUSE-SU-2024:2429-1 No score

Security update for sqlite3

This update for sqlite3 fixes the following issues:

  • CVE-2023-2137: Fixed heap buffer overflow (bsc#1210660).
Record
SUSE-SU-2024:2429-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt5-qtwebengine
Alpine:v3.17
 before 5.15.12-r4
5.15.12-r4
qt5-qtwebengine
Alpine:v3.18
 before 5.15.13-r1
5.15.13-r1
qt5-qtwebengine
Alpine:v3.19
 before 5.15.13-r1
5.15.13-r1
qt5-qtwebengine
Alpine:v3.20
 before 5.15.13-r1
5.15.13-r1
qt5-qtwebengine
Alpine:v3.21
 before 5.15.13-r1
5.15.13-r1
qt5-qtwebengine
Alpine:v3.22
 before 5.15.13-r1
5.15.13-r1
qt5-qtwebengine
Alpine:v3.23
 before 5.15.13-r1
5.15.13-r1
chromium
Debian:12
 before 112.0.5615.138-1
112.0.5615.138-1
chromium
Debian:13
 before 112.0.5615.138-1
112.0.5615.138-1
chromium
Debian:14
 before 112.0.5615.138-1
112.0.5615.138-1
Show 33 moreShow less
Affected packages
PackageAffectedFixed
chromium
Debian:11
From an advisory covering 5 CVEs
 before 112.0.5615.138-1~deb11u1, plus listed versions
100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1
Show 45 moreShow less
100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1
112.0.5615.138-1~deb11u1
sqlite3
Mageia:9
From an advisory covering 2 CVEs
 before 3.40.1-1.1.mga9
3.40.1-1.1.mga9
sqlite3
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.44.0-9.29.1
3.44.0-9.29.1
sqlite3
SUSE:Linux Enterprise Server 12 SP5
 before 3.44.0-9.29.1
3.44.0-9.29.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.44.0-9.29.1
3.44.0-9.29.1
sqlite3
SUSE:Linux Enterprise Micro 5.3
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Micro 5.4
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Micro 5.5
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Micro 5.1
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Linux Enterprise Micro 5.2
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
SUSE:Enterprise Storage 7.1
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
openSUSE:Leap Micro 5.3
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
openSUSE:Leap Micro 5.4
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
openSUSE:Leap 15.4
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
sqlite3
openSUSE:Leap 15.5
 before 3.44.0-150000.3.23.1
3.44.0-150000.3.23.1
chromium
SUSE:Package Hub 15 SP4
From an advisory covering 5 CVEs
 before 112.0.5615.165-bp154.2.84.1
112.0.5615.165-bp154.2.84.1
chromium
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 112.0.5615.165-bp154.2.84.1
112.0.5615.165-bp154.2.84.1
opera
openSUSE:Leap 15.4 NonFree
From an advisory covering 43 CVEs
 before 99.0.4788.13-lp154.2.47.1
99.0.4788.13-lp154.2.47.1
opera
openSUSE:Leap 15.5 NonFree
From an advisory covering 89 CVEs
 before 99.0.4788.13-lp155.3.6.1
99.0.4788.13-lp155.3.6.1
chromium
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 112.0.5615.165-1.1
112.0.5615.165-1.1
chromium
openSUSE:Tumbleweed
From an advisory covering 2310 CVEs
 before 113.0.5672.92-1.1
113.0.5672.92-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2137 is a high vulnerability (CVSS 8.8) in Google Chrome, published April 19, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in qt5-qtwebengine 5.15.12-r4.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 47 versions, 2,142 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open