--- id: CVE-2019-16168 title: >- In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." summary: >- In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H' cwe: - CWE-369 - CWE-369 vendor: sqlite product: sqlite affected: - 'sqlite >= 3.8.5, <= 3.29.0' - active_iq_unified_manager >= 7.3 - active_iq_unified_manager >= 9.5 - 'e-series_santricity_os_controller >= 11.0.0, <= 11.60.3' - oncommand_insight - oncommand_workflow_automation - ontap_select_deploy_administration_utility - santricity_unified_manager - steelstore_cloud_integrated_storage - ubuntu_linux = 12.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.04 - ubuntu_linux = 19.10 - fedora = 30 - debian_linux = 9.0 - nessus_agent <= 8.2.3 - communications_design_studio = 7.3.4.3.0 - communications_design_studio = 7.3.5.5.0 - communications_design_studio = 7.4.0.4.0 - jdk = 1.8.0 - jre = 1.8.0 - 'mysql >= 8.0.0, <= 8.0.18' - outside_in_technology = 8.5.4 - solaris = 11 - zfs_storage_appliance = 8.8 - policy_auditor < 6.5.1 patched: - policy_auditor 6.5.1 published: '2019-09-09' updated: '2026-10-14' sourceUpdated: '2026-10-14T07:16:48.253' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-16168' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html' label: cve@mitre.org - url: 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202003-16' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20190926-0003/' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200122-0003/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4205-1/' label: cve@mitre.org - url: >- https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: cve@mitre.org - url: 'https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62' label: cve@mitre.org - url: 'https://www.sqlite.org/src/timeline?c=98357d8c1263920b' label: cve@mitre.org - url: 'https://www.tenable.com/security/tns-2021-08' label: cve@mitre.org - url: 'https://www.tenable.com/security/tns-2021-11' label: cve@mitre.org - url: 'https://www.tenable.com/security/tns-2021-14' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202003-16' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190926-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200122-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4205-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.sqlite.org/src/timeline?c=98357d8c1263920b' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.tenable.com/security/tns-2021-08' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.tenable.com/security/tns-2021-11' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.tenable.com/security/tns-2021-14' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.04253 epssPercentile: 0.90846 ingestedAt: '2026-10-14T07:21:04.818Z' --- ## Overview In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." ## Affected - `sqlite >= 3.8.5, <= 3.29.0` - `active_iq_unified_manager >= 7.3` - `active_iq_unified_manager >= 9.5` - `e-series_santricity_os_controller >= 11.0.0, <= 11.60.3` - `oncommand_insight` - `oncommand_workflow_automation` - `ontap_select_deploy_administration_utility` - `santricity_unified_manager` - `steelstore_cloud_integrated_storage` - `ubuntu_linux = 12.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.04` - `ubuntu_linux = 19.10` - `fedora = 30` - `debian_linux = 9.0` - `nessus_agent <= 8.2.3` - `communications_design_studio = 7.3.4.3.0` - `communications_design_studio = 7.3.5.5.0` - `communications_design_studio = 7.4.0.4.0` - `jdk = 1.8.0` - `jre = 1.8.0` - `mysql >= 8.0.0, <= 8.0.18` - `outside_in_technology = 8.5.4` - `solaris = 11` - `zfs_storage_appliance = 8.8` - `policy_auditor < 6.5.1` ## Remediation Upgrade past the affected range: - `policy_auditor 6.5.1`