NetSight
IP …
high7.5

CVE-2015-3416

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which al…

Impact

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04
SqliteSqlite
through 3.8.8.3
DebianDebian Linux
Version 8.0
AppleMac Os X
through 10.6.8
AppleWatchos
through 1.0.1
PhpPhp
from 5.4.0 before 5.4.42
from 5.5.0 before 5.5.26
from 5.6.0 before 5.6.10

Weakness classification

CWE-190

References