CVE-2019-19880
CVE-2019-19880
This page contains facts from public vulnerability sources. Check the original advisory before updating.
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
CVSS 7.5 · High · EPSS 6.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
chromium Debian:12
- Affected ranges
- ECOSYSTEM: < 80.0.3987.106-1
Update to 80.0.3987.106-1
chromium Debian:13
- Affected ranges
- ECOSYSTEM: < 80.0.3987.106-1
Update to 80.0.3987.106-1
chromium Debian:14
- Affected ranges
- ECOSYSTEM: < 80.0.3987.106-1
Update to 80.0.3987.106-1
sqlite3 Debian:12
- Affected ranges
- ECOSYSTEM: < 3.30.1+fossil191229-1
Update to 3.30.1+fossil191229-1
sqlite3 Debian:13
- Affected ranges
- ECOSYSTEM: < 3.30.1+fossil191229-1
Update to 3.30.1+fossil191229-1
sqlite3 Debian:14
- Affected ranges
- ECOSYSTEM: < 3.30.1+fossil191229-1
Update to 3.30.1+fossil191229-1
Original sources
- https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54
- https://security.netapp.com/advisory/ntap-20200114-0001/
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
- https://access.redhat.com/errata/RHSA-2020:0514
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
- https://www.debian.org/security/2020/dsa-4638
- https://usn.ubuntu.com/4298-1/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19880