According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - SQLite3 from 3.6.0 to and including 3.27.2 is     vulnerable to heap out-of-bound read in the rtreenode()     function when handling invalid rtree     tables.(CVE-2019-8457)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Google reports :

A heap-buffer overflow (sometimes a crash) can arise when running a SQL request on malformed sqlite3 databases.

According to the version of the sqlite package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other     products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-     read or possibly unspecified other impact. (CVE-2017-10989)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Apple iOS running on the mobile device is prior to 11. It is, therefore, affected by multiple vulnerabilities as described in the HT208112 security advisory.

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, 10.12.x prior to 10.12.6, or is not macOS 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - AppSandbox
  - AppleScript
  - Application Firewall
  - ATS
  - Audio
  - CFNetwork
  - CFNetwork Proxies
  - CFString
  - Captive Network Assistant
  - CoreAudio
  - CoreText
  - DesktopServices
  - Directory Utility
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - IOFireWireFamily
  - ImageIO
  - Installer
  - Kernel
  - kext tools
  - libarchive
  - libc
  - libexpat
  - Mail
  - Mail Drafts
  - ntp
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - SQLite
  - Sandbox
  - Screen Lock
  - Security
  - Spotlight
  - WebKit
  - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Several flaws were corrected in SQLite, a SQL database engine.

CVE-2017-2518

A use-after-free bug in the query optimizer may cause a buffer overflow and application crash via a crafted SQL statement.

CVE-2017-2519

Insufficient size of the reference count on Table objects could lead to a denial of service or arbitrary code execution.

CVE-2017-2520

The sqlite3_value_text() interface returned a buffer that was not large enough to hold the complete string plus zero terminator when the input was a zeroblob. This could lead to arbitrary code execution or a denial of service.

CVE-2017-10989

SQLite mishandles undersized RTree blobs in a crafted database leading to a heap-based buffer over-read or possibly unspecified other impact.

CVE-2018-8740

Databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference.

For Debian 8 'Jessie', these problems have been fixed in version 3.8.7.1-1+deb8u4.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a heap-based buffer over-read vulnerability in SQLite, a lightweight database engine. The getNodeSize function in ext/rtree/rtree.c mishandled undersized RTree blobs in a specially crafted database,

For Debian 7 'Wheezy', this issue has been fixed in sqlite3 version 3.7.13-1+deb7u4.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4019-1 advisory.

    It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this     issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2518, CVE-2017-2520)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
    (CVE-2018-20505)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu     18.10. (CVE-2018-20346, CVE-2018-20506)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to access sensitive information. (CVE-2019-8457)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and     Ubuntu 18.10. (CVE-2019-9936)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS and Ubuntu 18.10. (CVE-2019-9937)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)

    It was discovered that SQLite incorrectly handled certain databases. An attacker could possibly use this     issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)

    It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue     to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2519)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
129253	EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2019-2060)	Nessus	Huawei Local Security Checks	9/24/2019	4/23/2024	critical
102279	FreeBSD : sqlite3 -- heap-buffer overflow (9245681c-7c3c-11e7-b5af-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	8/9/2017	12/2/2025	critical
126555	EulerOS Virtualization for ARM 64 3.0.2.0 : sqlite (EulerOS-SA-2019-1713)	Nessus	Huawei Local Security Checks	7/9/2019	5/10/2024	critical
220282	Linux Distros Unpatched Vulnerability : CVE-2017-10989	Nessus	Misc.	3/4/2025	7/19/2026	critical
103420	Apple iOS < 11 Multiple Vulnerabilities	Nessus	Mobile Devices	9/21/2017	8/10/2026	critical
103598	macOS < 10.13 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	10/3/2017	11/19/2025	critical
121133	Debian DLA-1633-1 : sqlite3 security update	Nessus	Debian Local Security Checks	1/14/2019	6/27/2024	critical
101319	Debian DLA-1018-1 : sqlite3 security update	Nessus	Debian Local Security Checks	7/10/2017	12/12/2025	critical
126848	EulerOS 2.0 SP2 : sqlite (EulerOS-SA-2019-1720)	Nessus	Huawei Local Security Checks	7/22/2019	5/9/2024	critical
126065	Ubuntu 16.04 LTS / 18.04 LTS : SQLite vulnerabilities (USN-4019-1)	Nessus	Ubuntu Local Security Checks	6/20/2019	9/3/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical