{"id":"CVE-2019-16168","title":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","summary":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-369","CWE-369"],"vendor":"sqlite","product":"sqlite","affected":["sqlite >= 3.8.5, <= 3.29.0","active_iq_unified_manager >= 7.3","active_iq_unified_manager >= 9.5","e-series_santricity_os_controller >= 11.0.0, <= 11.60.3","oncommand_insight","oncommand_workflow_automation","ontap_select_deploy_administration_utility","santricity_unified_manager","steelstore_cloud_integrated_storage","ubuntu_linux = 12.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 19.04","ubuntu_linux = 19.10","fedora = 30","debian_linux = 9.0","nessus_agent <= 8.2.3","communications_design_studio = 7.3.4.3.0","communications_design_studio = 7.3.5.5.0","communications_design_studio = 7.4.0.4.0","jdk = 1.8.0","jre = 1.8.0","mysql >= 8.0.0, <= 8.0.18","outside_in_technology = 8.5.4","solaris = 11","zfs_storage_appliance = 8.8","policy_auditor < 6.5.1"],"patched":["policy_auditor 6.5.1"],"published":"2019-09-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:48.253","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-16168","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html","label":"cve@mitre.org"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202003-16","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190926-0003/","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20200122-0003/","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4205-1/","label":"cve@mitre.org"},{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"cve@mitre.org"},{"url":"https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62","label":"cve@mitre.org"},{"url":"https://www.sqlite.org/src/timeline?c=98357d8c1263920b","label":"cve@mitre.org"},{"url":"https://www.tenable.com/security/tns-2021-08","label":"cve@mitre.org"},{"url":"https://www.tenable.com/security/tns-2021-11","label":"cve@mitre.org"},{"url":"https://www.tenable.com/security/tns-2021-14","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-16","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190926-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20200122-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4205-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.sqlite.org/src/timeline?c=98357d8c1263920b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2021-08","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2021-11","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2021-14","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.04253,"epssPercentile":0.90846,"ingestedAt":"2026-10-14T07:21:04.818Z","slug":"CVE-2019-16168","body":"## Overview\n\nIn SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"\n\n## Affected\n\n- `sqlite >= 3.8.5, <= 3.29.0`\n- `active_iq_unified_manager >= 7.3`\n- `active_iq_unified_manager >= 9.5`\n- `e-series_santricity_os_controller >= 11.0.0, <= 11.60.3`\n- `oncommand_insight`\n- `oncommand_workflow_automation`\n- `ontap_select_deploy_administration_utility`\n- `santricity_unified_manager`\n- `steelstore_cloud_integrated_storage`\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 19.04`\n- `ubuntu_linux = 19.10`\n- `fedora = 30`\n- `debian_linux = 9.0`\n- `nessus_agent <= 8.2.3`\n- `communications_design_studio = 7.3.4.3.0`\n- `communications_design_studio = 7.3.5.5.0`\n- `communications_design_studio = 7.4.0.4.0`\n- `jdk = 1.8.0`\n- `jre = 1.8.0`\n- `mysql >= 8.0.0, <= 8.0.18`\n- `outside_in_technology = 8.5.4`\n- `solaris = 11`\n- `zfs_storage_appliance = 8.8`\n- `policy_auditor < 6.5.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `policy_auditor 6.5.1`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":35.8,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[]}