CVE-2020-35525
In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.
- Update to 3.22.0-1ubuntu0.6
Published Updated
PatchFirst · Latest vulnerabilities
sqlite3 vulnerabilities
Vulnerabilities published for sqlite3 in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 26
CVE-2022-35737
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
- Update to 3.22.0-1ubuntu0.7
Published UpdatedCVE-2021-36690
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.
- Update to 3.22.0-1ubuntu0.5
Published UpdatedCVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
- Update to 3.22.0-1ubuntu0.4
Published UpdatedCVE-2020-13632
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
- Update to 3.22.0-1ubuntu0.4
Published UpdatedCVE-2020-13434
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
- Update to 3.22.0-1ubuntu0.4
Published UpdatedCVE-2020-9327
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-19959
ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-20218
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-19925
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-19923
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-19926
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-13753
Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-13752
Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-13751
Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-13750
Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-13734
Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Update to 3.22.0-1ubuntu0.3
Published UpdatedCVE-2019-16168
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
- Update to 3.22.0-1ubuntu0.2
Published UpdatedCVE-2019-5827
Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Update to 3.22.0-1ubuntu0.2
Published UpdatedCVE-2019-8457
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
- Update to 3.22.0-1ubuntu0.1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.