Search for packages
Package details: pkg:deb/ubuntu/sqlite3@3.31.1-1ubuntu1
purl pkg:deb/ubuntu/sqlite3@3.31.1-1ubuntu1
Next non-vulnerable version 3.31.1-4ubuntu0.2
Latest non-vulnerable version 3.31.1-4ubuntu0.2
Risk 3.5
Vulnerabilities affecting this package (7)
Vulnerability Summary Fixed by
VCID-4pf6-reg9-aaab
Aliases:
CVE-2020-13434
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-5n57-agr1-aaah
Aliases:
CVE-2020-13632
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-cfnz-66fy-aaak
Aliases:
CVE-2020-13631
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-ptpe-j7h1-aaah
Aliases:
CVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-rcwn-cr9h-aaab
Aliases:
CVE-2020-13435
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-vx1u-ujaf-aaaf
Aliases:
CVE-2020-11655
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
3.31.1-4ubuntu0.1
Affected by 1 other vulnerability.
VCID-xevh-jde9-aaak
Aliases:
CVE-2020-15358
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
3.31.1-4ubuntu0.2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (9)
Vulnerability Summary Aliases
VCID-4vdc-rrqy-aaaq selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. CVE-2019-20218
VCID-d1jp-bvsh-aaas Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page. CVE-2019-13750
VCID-k9rk-9qya-aaab alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. CVE-2019-19645
VCID-mv66-zgd3-aaap Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. CVE-2019-13752
VCID-p3bp-nq76-aaak Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. CVE-2019-13751
VCID-psdz-r5t1-aaan Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2019-13734
VCID-r5w3-e7ct-aaan Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. CVE-2019-13753
VCID-s3q7-sc5w-aaar multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880. CVE-2019-19926
VCID-vwku-mt64-aaaf SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. CVE-2019-19603

Date Actor Action Vulnerability Source VulnerableCode Version