Summary
It was discovered that SQLite incorrectly handled certain corruped schemas.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 18.04 LTS. (CVE-2018-8740)
It was discovered that SQLite incorrectly handled certain SELECT
statements. An attacker could possibly use this issue to cause a denial of
service. This issue was only addressed in Ubuntu 19.10. (CVE-2019-19603)
It was discovered that SQLite incorrectly handled certain self-referential
views. An attacker could possibly use this issue to cause a denial of
service. This issue was only addressed in Ubuntu 19.10. (CVE-2019-19645)
Henry Liu discovered that SQLite incorrectly handled certain malformed
window-function queries. An attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 19.10 and Ubuntu 20.04
LTS. (CVE-2020-11655)
It was discovered that SQLite incorrectly handled certain string
operations. An attacker could use this issue to cause SQLite to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2020-13434)
It was discovered that SQLite incorrectly handled certain expressions. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-13435)
It was discovered that SQLite incorrectly handled certain fts3 queries. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2020-13630)
It was discovered that SQLite incorrectly handled certain virtual table
names. An attacker could possibly use this issue to cause a denial of
service. This issue was only addressed in Ubuntu 19.10 and Ubuntu 20.04
LTS. (CVE-2020-13631)
It was discovered that SQLite incorrectly handled certain fts3 queries. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2020-13632)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | sqlite3 | 3.11.0-1ubuntu1.5 |
| Ubuntu · 18.04 LTS 18.04:LTS | sqlite3 | 3.22.0-1ubuntu0.4 |
| Ubuntu · 20.04 LTS 20.04:LTS | sqlite3 | 3.31.1-4ubuntu0.1 |
Vulnerabilities 9
-
Unscored —
In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL poin…
-
Unscored —CVE-2019-19603 EPSS 11%
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
-
Unscored —
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential v…
-
Unscored —
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-functio…
-
Unscored —
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
-
Unscored —
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
-
Unscored —
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
-
Unscored —
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c a…
-
Unscored —
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
References
-
report
https://ubuntu.com/security/CVE-2018-8740
-
report
https://ubuntu.com/security/CVE-2019-19603
-
report
https://ubuntu.com/security/CVE-2019-19645
-
report
https://ubuntu.com/security/CVE-2020-11655
-
report
https://ubuntu.com/security/CVE-2020-13434
-
report
https://ubuntu.com/security/CVE-2020-13435
-
report
https://ubuntu.com/security/CVE-2020-13630
-
report
https://ubuntu.com/security/CVE-2020-13631
-
report
https://ubuntu.com/security/CVE-2020-13632