CVE-2019-16168

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

References

https://www.sqlite.org/src/timeline?c=98357d8c1263920b

https://www.mail-archive.com/[email protected]/msg116312.html

https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62

https://security.netapp.com/advisory/ntap-20190926-0003/

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html

https://usn.ubuntu.com/4205-1/

https://lists.fedoraproject.org/archives/list/[email protected]/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/

https://www.oracle.com/security-alerts/cpujan2020.html

https://security.netapp.com/advisory/ntap-20200122-0003/

https://security.gentoo.org/glsa/202003-16

https://www.oracle.com/security-alerts/cpuapr2020.html

https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html

https://www.tenable.com/security/tns-2021-08

https://www.tenable.com/security/tns-2021-11

https://www.tenable.com/security/tns-2021-14

https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Details

Source: MITRE

Published: 2019-09-09

Updated: 2021-07-31

Type: CWE-369

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 2.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* versions from 3.8.5 to 3.29.0 (inclusive)

Configuration 2

OR

cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from 11.0.0 to 11.60.3 (inclusive)

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 4

OR

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Configuration 5

OR

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 6

OR

cpe:2.3:a:tenable:nessus_agent:*:*:*:*:*:*:*:* versions up to 8.2.3 (inclusive)

Configuration 7

OR

cpe:2.3:a:oracle:communications_design_studio:7.3.4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_design_studio:7.3.5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_design_studio:7.4.0.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.8.0:update231:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.8.0:update231:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions from 8.0.0 to 8.0.18 (inclusive)

cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*

cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*

cpe:2.3:o:oracle:zfs_storage_appliance:8.8:*:*:*:*:*:*:*

Tenable Plugins

View all (26 total)

IDNameProductFamilySeverity
153643SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2021:3215-1)NessusSuSE Local Security Checks
critical
152986Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)NessusMisc.
high
151985Tenable.sc < 5.19.0 Multiple Vulnerabilities (TNS-2021-14) (deprecated)NessusMisc.
high
150798Tenable Nessus 8.x.x < 8.15.0 Multiple Vulnerabilities (TNS-2021-11)NessusMisc.
medium
149744CentOS 8 : mingw packages (CESA-2021:1968)NessusCentOS Local Security Checks
high
149666RHEL 8 : mingw packages (RHSA-2021:1968)NessusRed Hat Local Security Checks
high
148392Tenable Nessus Agent < 8.2.4 Multiple Vulnerabilities (TNS-2021-08)NessusMisc.
high
147397NewStart CGSL MAIN 6.02 : sqlite Multiple Vulnerabilities (NS-SA-2021-0064)NessusNewStart CGSL Local Security Checks
high
145815CentOS 8 : sqlite (CESA-2020:4442)NessusCentOS Local Security Checks
high
142752Oracle Linux 8 : sqlite (ELSA-2020-4442)NessusOracle Linux Local Security Checks
high
142429RHEL 8 : sqlite (RHSA-2020:4442)NessusRed Hat Local Security Checks
high
134593GLSA-202003-16 : SQLite: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
133096Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1387)NessusAmazon Linux Local Security Checks
high
132992Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU)NessusWindows
high
132960Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU) (Unix)NessusMisc.
high
132958MySQL 8.0.x < 8.0.19 Multiple Vulnerabilities (Jan 2020 CPU)NessusDatabases
critical
132833EulerOS Virtualization for ARM 64 3.0.5.0 : sqlite (EulerOS-SA-2020-1079)NessusHuawei Local Security Checks
critical
131715Fedora 30 : sqlite (2019-b1636e0b70)NessusFedora Local Security Checks
medium
131561Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : sqlite3 vulnerabilities (USN-4205-1)NessusUbuntu Local Security Checks
high
130828EulerOS 2.0 SP8 : sqlite (EulerOS-SA-2019-2119)NessusHuawei Local Security Checks
medium
130205Photon OS 2.0: Sqlite PHSA-2019-2.0-0184NessusPhotonOS Local Security Checks
medium
129745openSUSE Security Update : sqlite3 (openSUSE-2019-2300)NessusSuSE Local Security Checks
medium
129744openSUSE Security Update : sqlite3 (openSUSE-2019-2298)NessusSuSE Local Security Checks
medium
129582SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2019:2536-1)NessusSuSE Local Security Checks
medium
129581SUSE SLED15 / SLES15 Security Update : sqlite3 (SUSE-SU-2019:2533-1)NessusSuSE Local Security Checks
medium
129165Photon OS 3.0: Sqlite PHSA-2019-3.0-0030NessusPhotonOS Local Security Checks
medium