NetSight
IP …
high7.5

CVE-2015-3415

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cau…

Impact

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

Affected products

VendorProductAffected versions
AppleMac Os X
Version 10.10.5
AppleWatchos
Version 1.0.1
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04
SqliteSqlite
through 3.8.8.3
PhpPhp
from 5.4.0 before 5.4.42
from 5.5.0 before 5.5.26
from 5.6.0 before 5.6.10

Weakness classification

CWE-404

References