p PatchFirst

CVE-2015-3416

CVE-2015-3416

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

EPSS 5.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • sqlite3 Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.8.9-1

    Update to 3.8.9-1

  • sqlite3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.8.9-1

    Update to 3.8.9-1

  • sqlite3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.8.9-1

    Update to 3.8.9-1

  • sqlite3 Ubuntu:14.04:LTS

    Versions
    • 3.7.17-1ubuntu1
    • 3.8.0.2-1ubuntu1
    • 3.8.1-1ubuntu1
    • 3.8.1-1ubuntu3
    • 3.8.2-1ubuntu1
    • 3.8.2-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 3.8.2-1ubuntu2.1

    Update to 3.8.2-1ubuntu2.1

  • sqlite Ubuntu:14.04:LTS

    Versions
    • 2.8.17-8fakesync1
    • 2.8.17-9fakesync1
    • 2.8.17-10ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sqlite Ubuntu:16.04:LTS

    Versions
    • 2.8.17-12fakesync1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sqlite Ubuntu:18.04:LTS

    Versions
    • 2.8.17-14fakesync1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sqlite Ubuntu:20.04:LTS

    Versions
    • 2.8.17-15fakesync1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sqlite Ubuntu:22.04:LTS

    Versions
    • 2.8.17-15fakesync1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →