Search for packages
Package details: pkg:deb/ubuntu/sqlite3@3.29.0-2ubuntu0.2
purl pkg:deb/ubuntu/sqlite3@3.29.0-2ubuntu0.2
Next non-vulnerable version 3.31.1-4ubuntu0.2
Latest non-vulnerable version 3.31.1-4ubuntu0.2
Risk 3.5
Vulnerabilities affecting this package (9)
Vulnerability Summary Fixed by
VCID-4pf6-reg9-aaab
Aliases:
CVE-2020-13434
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-5n57-agr1-aaah
Aliases:
CVE-2020-13632
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-cfnz-66fy-aaak
Aliases:
CVE-2020-13631
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-k9rk-9qya-aaab
Aliases:
CVE-2019-19645
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-1ubuntu1
Affected by 7 other vulnerabilities.
VCID-ptpe-j7h1-aaah
Aliases:
CVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-rcwn-cr9h-aaab
Aliases:
CVE-2020-13435
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-vwku-mt64-aaaf
Aliases:
CVE-2019-19603
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-1ubuntu1
Affected by 7 other vulnerabilities.
VCID-vx1u-ujaf-aaaf
Aliases:
CVE-2020-11655
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
3.29.0-2ubuntu0.3
Affected by 8 other vulnerabilities.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-xevh-jde9-aaak
Aliases:
CVE-2020-15358
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
3.31.1-4ubuntu0.2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (13)
Vulnerability Summary Aliases
VCID-227a-c7y7-aaah In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. CVE-2020-9327
VCID-4vdc-rrqy-aaaq selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. CVE-2019-20218
VCID-d1jp-bvsh-aaas Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page. CVE-2019-13750
VCID-k8mw-375e-aaaa flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results). CVE-2019-19923
VCID-mv66-zgd3-aaap Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. CVE-2019-13752
VCID-mx17-vf2g-aaas SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling. CVE-2019-19924
VCID-p3bp-nq76-aaak Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. CVE-2019-13751
VCID-pcm1-uvnf-aaah ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind. CVE-2019-19959
VCID-psdz-r5t1-aaan Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2019-13734
VCID-r5w3-e7ct-aaan Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. CVE-2019-13753
VCID-s3q7-sc5w-aaar multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880. CVE-2019-19926
VCID-spam-m9bv-aaam exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. CVE-2019-19880
VCID-tbmy-yg28-aaac zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. CVE-2019-19925

Date Actor Action Vulnerability Source VulnerableCode Version