NetSight
IP …
high7.5

CVE-2015-3414

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of servic…

Impact

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

Affected products

VendorProductAffected versions
SqliteSqlite
through 3.8.8.3
AppleMac Os X
Version 10.10.5
AppleWatchos
Version 1.0.1
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04
PhpPhp
from 5.4.0 before 5.4.42
from 5.5.0 before 5.5.26
from 5.6.0 before 5.6.10

Weakness classification

CWE-908

References