high7.5
CVE-2019-19926
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls.
Impact
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sqlite | Sqlite | Version 3.30.1 |
| Siemens | Sinec Infrastructure Network Services | before 1.0.1.1 |
| Oracle | Mysql Workbench | through 8.0.19 |
| Debian | Debian Linux | Versions 9.0, 10.0 |
| Redhat | Enterprise Linux Desktop | Version 6.0 |
| Redhat | Enterprise Linux Server | Version 6.0 |
| Redhat | Enterprise Linux Workstation | Version 6.0 |
| Opensuse | Backports Sle | Version 15.0 |
| Opensuse | Leap | Version 15.1 |
| Suse | Package Hub | All versions |
| Netapp | Cloud Backup | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
- https://access.redhat.com/errata/RHSA-2020:0514
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/sqlite/sqlite/commit/8428b3b437569338a9d1e10c4cd8154acbe33089
- https://security.netapp.com/advisory/ntap-20200114-0003/
- https://usn.ubuntu.com/4298-1/
- https://usn.ubuntu.com/4298-2/
- https://www.debian.org/security/2020/dsa-4638
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html