Browse CVEs

HIGH 7.5 CVE-2020-11655 SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo ob… SQLite after 12.0.3 Fix from $1,9502020-04-09 HIGH 7.5 CVE-2020-9327 In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column o… SQLite 1.0.1.1+ Fix from $1,9502020-02-21 HIGH 7.5 CVE-2019-19959 ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to … SQLite Patch available Fix from $1,9502020-01-03 HIGH 7.5 CVE-2019-20218 selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. SQLite after 8.0.19 Fix from $1,9502020-01-02 HIGH 7.5 CVE-2019-19925EPSS 7% zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. SQLite 1.0.1.1+ Fix from $1,9502019-12-24 HIGH 7.5 CVE-2019-19923EPSS 7% flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view.… SQLite 1.0.1.1+ Fix from $1,9502019-12-24 MEDIUM 5.3 CVE-2019-19924EPSS 8% SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite(… SQLite 1.0.1.1+ Fix from $1,6002019-12-24 HIGH 7.5 CVE-2019-19926EPSS 7% multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE:… SQLite 1.0.1.1+ Fix from $1,9502019-12-23 HIGH 7.5 CVE-2019-19880EPSS 7% exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER B… SQLite Patch available Fix from $1,9502019-12-18 CRITICAL 9.8 CVE-2019-19646EPSS 5% pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. SQLite 1.0.1.1 / 5.19.0+ Fix from $2,3002019-12-09 HIGH 7.5 CVE-2019-19603EPSS 8% SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. SQLite 1.0.1.1+ Fix from $1,9502019-12-09 MEDIUM 5.5 CVE-2019-19645 alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER… SQLite 1.0.1.1 / 5.19.0+ Fix from $1,6002019-12-09 CRITICAL 9.8 CVE-2019-19317 lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a den… SQLite 1.0.1.1+ Fix from $2,3002019-12-05 MEDIUM 5.9 CVE-2019-19242 SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. SQLite 1.0.1.1+ Fix from $1,6002019-11-27 HIGH 7.5 CVE-2019-19244 sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usag… SQLite 1.0.1.1+ Fix from $1,9502019-11-25 MEDIUM 6.5 CVE-2019-16168 In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat… SQLite after 11.60.3 Fix from $1,6002019-09-09 CRITICAL 9.8 CVE-2019-8457EPSS 45% SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. SQLite after 3.27.2 Fix from $2,3002019-05-30 HIGH 8.1 CVE-2019-5018EPSS 7% An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause … SQLite No fix yet Fix from $1,9502019-05-10 HIGH 8.1 CVE-2018-20506EPSS 8% SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge… SQLite 3.25.3 / 5.1.3+ Fix from $1,9502019-04-03 HIGH 7.5 CVE-2018-20505EPSS 7% SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash)… SQLite 5.1.3 / 7.10+ Fix from $1,9502019-04-03 HIGH 7.5 CVE-2019-9936 In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, whi… SQLite Patch available Fix from $1,9502019-03-22 HIGH 7.5 CVE-2019-9937EPSS 6% In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5Chu… SQLite Patch available Fix from $1,9502019-03-22 HIGH 8.1 CVE-2018-20346EPSS 10% SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur … SQLite 3.25.3 / 71.0.3578.80+ Fix from $1,9502018-12-21 HIGH 7.5 CVE-2018-8740EPSS 8% In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to bu… SQLite after 3.22.0 Fix from $1,9502018-03-17 HIGH 7.5 CVE-2017-15286 SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQL… SQLite No fix yet Fix from $1,9502017-10-12 MEDIUM 5.5 CVE-2017-13685 The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted… SQLite Mitigation only Fix from $1,6002017-08-29 CRITICAL 9.8 CVE-2017-10989EPSS 9% The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a cr… SQLite after 3.19.3 Fix from $2,3002017-07-07 MEDIUM 5.9 CVE-2016-6153 os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive i… SQLite after 3.12.2 Fix from $1,6002016-09-26 MEDIUM 6.8 CVE-2015-6607 SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586. SQLite after 3.8.8.3 Fix from $1,6002015-10-06 HIGH 10.0 CVE-2015-5895EPSS 9% Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. SQLite after 3.8.10.1 Fix from $1,9502015-09-18