CVE-2019-8457
CVE-2019-8457
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
CVSS 9.8 · Critical · EPSS 45.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
sqlite
- Versions
- From 3.6.0 to 3.27.2 including: Affected
No fix published
db5.3 Debian:12
- Affected ranges
- ECOSYSTEM: < 5.3.28+dfsg1-0.9
Update to 5.3.28+dfsg1-0.9
db5.3 Debian:13
- Affected ranges
- ECOSYSTEM: < 5.3.28+dfsg1-0.9
Update to 5.3.28+dfsg1-0.9
db5.3 Debian:14
- Affected ranges
- ECOSYSTEM: < 5.3.28+dfsg1-0.9
Update to 5.3.28+dfsg1-0.9
sqlite3 Debian:12
- Affected ranges
- ECOSYSTEM: < 3.27.2-3
Update to 3.27.2-3
sqlite3 Debian:13
- Affected ranges
- ECOSYSTEM: < 3.27.2-3
Update to 3.27.2-3
sqlite3 Debian:14
- Affected ranges
- ECOSYSTEM: < 3.27.2-3
Update to 3.27.2-3
db5.3 Ubuntu:Pro:14.04:LTS
- Versions
- 5.3.21-2
- 5.3.28-2
- 5.3.28-3
- 5.3.28-3ubuntu1
- 5.3.28-3ubuntu2
- 5.3.28-3ubuntu3
- 5.3.28-3ubuntu3.1
- Affected ranges
- ECOSYSTEM: < 5.3.28-3ubuntu3.1+esm1
Update to 5.3.28-3ubuntu3.1+esm1
sqlite3 Ubuntu:Pro:14.04:LTS
- Versions
- 3.7.17-1ubuntu1
- 3.8.0.2-1ubuntu1
- 3.8.1-1ubuntu1
- 3.8.1-1ubuntu3
- 3.8.2-1ubuntu1
- 3.8.2-1ubuntu2
- 3.8.2-1ubuntu2.1
- 3.8.2-1ubuntu2.2
- Affected ranges
- ECOSYSTEM: < 3.8.2-1ubuntu2.2+esm1
Update to 3.8.2-1ubuntu2.2+esm1
db5.3 Ubuntu:16.04:LTS
- Versions
- 5.3.28-11
- 5.3.28-11ubuntu0.1
- Affected ranges
- ECOSYSTEM: < 5.3.28-11ubuntu0.2
Update to 5.3.28-11ubuntu0.2
sqlite3 Ubuntu:16.04:LTS
- Versions
- 3.8.11.1-1
- 3.9.1-2
- 3.9.2-1
- 3.10.0-1
- 3.10.1-1
- 3.10.2-1
- 3.11.0-1ubuntu1
- 3.11.0-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 3.11.0-1ubuntu1.2
Update to 3.11.0-1ubuntu1.2
sqlcipher Ubuntu:16.04:LTS
- Versions
- 3.2.0-1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
db5.3 Ubuntu:18.04:LTS
- Versions
- 5.3.28-13.1
- 5.3.28-13.1ubuntu1
- Affected ranges
- ECOSYSTEM: < 5.3.28-13.1ubuntu1.1
Update to 5.3.28-13.1ubuntu1.1
sqlite3 Ubuntu:18.04:LTS
- Versions
- 3.19.3-3
- 3.20.1-2
- 3.21.0-1
- 3.22.0-1
- Affected ranges
- ECOSYSTEM: < 3.22.0-1ubuntu0.1
Update to 3.22.0-1ubuntu0.1
qtwebengine-opensource-src Ubuntu:Pro:18.04:LTS
- Versions
- 5.9.1+dfsg-4
- 5.9.1+dfsg-4ubuntu1
- 5.9.2+dfsg-2ubuntu1
- 5.9.3+dfsg-0ubuntu1
- 5.9.4+dfsg-0ubuntu1
- 5.9.5+dfsg-0ubuntu2
- 5.9.5+dfsg-0ubuntu2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlcipher Ubuntu:18.04:LTS
- Versions
- 3.4.1-1
- 3.4.1-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
db5.3 Ubuntu:20.04:LTS
- Affected ranges
- ECOSYSTEM: < 5.3.28+dfsg1-0.6ubuntu1
Update to 5.3.28+dfsg1-0.6ubuntu1
qtwebengine-opensource-src Ubuntu:Pro:20.04:LTS
- Versions
- 5.12.4+dfsg-1ubuntu1
- 5.12.4+dfsg-1ubuntu3
- 5.12.5+dfsg-3ubuntu1
- 5.12.5+dfsg-6ubuntu2
- 5.12.5+dfsg-7
- 5.12.5+dfsg-7build1
- 5.12.8+dfsg-0ubuntu1
- 5.12.8+dfsg-0ubuntu1.1
- 5.12.8+dfsg-0ubuntu1.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlcipher Ubuntu:20.04:LTS
- Versions
- 3.4.1-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlcipher Ubuntu:22.04:LTS
- Versions
- 3.4.1-2
- 3.4.1-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebengine-opensource-src Ubuntu:Pro:22.04:LTS
- Versions
- 5.15.6+dfsg-1
- 5.15.6+dfsg-2
- 5.15.7+dfsg-2
- 5.15.8+dfsg-1
- 5.15.8+dfsg-1build1
- 5.15.8+dfsg-1build2
- 5.15.8+dfsg-2
- 5.15.9+dfsg-1
- 5.15.9+dfsg-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlcipher Ubuntu:24.04:LTS
- Versions
- 3.4.1-2build1
- 4.5.5-3
- 4.5.6-1
- 4.5.6-1build1
- 4.5.6-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebengine-opensource-src Ubuntu:Pro:24.04:LTS
- Versions
- 5.15.15+dfsg-2
- 5.15.15+dfsg-2build2
- 5.15.15+dfsg-2ubuntu1
- 5.15.16+dfsg-1
- 5.15.16+dfsg-1ubuntu2
- 5.15.16+dfsg-1ubuntu4
- 5.15.16+dfsg-3
- 5.15.16+dfsg-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebengine-opensource-src Ubuntu:25.10
- Versions
- 5.15.18+dfsg-2
- 5.15.18+dfsg-2build1
- 5.15.19+dfsg-1
- 5.15.19+dfsg2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://usn.ubuntu.com/4004-1/
- https://usn.ubuntu.com/4004-2/
- https://usn.ubuntu.com/4019-1/
- https://usn.ubuntu.com/4019-2/
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.sqlite.org/src/info/90acdbfce9c08858
- https://www.sqlite.org/releaselog/3_28_0.html
- https://security.netapp.com/advisory/ntap-20190606-0002/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-8457