CVE-2019-16168Medium· 6.5▾ SunlitIn SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.9 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.3%
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
sqlite >= 3.8.5, <= 3.29.0active_iq_unified_manager >= 7.3active_iq_unified_manager >= 9.5e-series_santricity_os_controller >= 11.0.0, <= 11.60.3oncommand_insightoncommand_workflow_automationontap_select_deploy_administration_utilitysantricity_unified_managersteelstore_cloud_integrated_storageubuntu_linux = 12.04ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 19.04ubuntu_linux = 19.10fedora = 30debian_linux = 9.0nessus_agent <= 8.2.3communications_design_studio = 7.3.4.3.0communications_design_studio = 7.3.5.5.0communications_design_studio = 7.4.0.4.0jdk = 1.8.0jre = 1.8.0mysql >= 8.0.0, <= 8.0.18outside_in_technology = 8.5.4solaris = 11zfs_storage_appliance = 8.8policy_auditor < 6.5.1Upgrade past the affected range:
policy_auditor 6.5.1Connected by shared product, vendor, weakness, or advisory.
CVE-2020-13871High· 7.5SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13434Medium· 5.5SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
CVE-2020-11656Critical· 9.8In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2020-11655High· 7.5SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
CVE-2020-9327High· 7.5In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
CVE-2019-19959High· 7.5ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.