Summary
USN-4019-1 fixed several vulnerabilities in sqlite3. This update provides
the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
It was discovered that SQLite incorrectly handled certain SQL files.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2017-2518)
It was discovered that SQLite incorrectly handled certain queries.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-20346, CVE-2018-20506)
It was discovered that SQLite incorrectly handled certain inputs.
An attacker could possibly use this issue to access sensitive information.
(CVE-2019-8457)
It was discovered that SQLite incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2016-6153)
It was discovered that SQLite incorrectly handled certain databases.
An attacker could possibly use this issue to access sensitive information.
This issue only affected Ubuntu 14.04 LTS. (CVE-2017-10989)
It was discovered that SQLite incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2017-13685)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | sqlite3 | 3.8.2-1ubuntu2.2+esm1 |
Vulnerabilities 7
-
Unscored —
os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow loc…
-
Unscored —
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles …
-
Unscored —
The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and ap…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvO…
-
Unscored —CVE-2018-20346 EPSS 10%
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow…
-
Unscored —
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow…
-
Unscored —CVE-2019-8457 EPSS 45%
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when han…
References
-
report
https://ubuntu.com/security/CVE-2016-6153
-
report
https://ubuntu.com/security/CVE-2017-2518
-
report
https://ubuntu.com/security/CVE-2017-10989
-
report
https://ubuntu.com/security/CVE-2017-13685
-
report
https://ubuntu.com/security/CVE-2018-20346
-
report
https://ubuntu.com/security/CVE-2018-20506
-
report
https://ubuntu.com/security/CVE-2019-8457