high8.1
CVE-2019-5018
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0.
Impact
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sqlite | Sqlite | Version 3.26.0 |
| Canonical | Ubuntu Linux | Versions 12.04, 16.04, 18.04, 19.04, 19.10 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/152809/Sqlite3-Window-Function-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/108294
- https://security.gentoo.org/glsa/201908-09
- https://security.netapp.com/advisory/ntap-20190521-0001/
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0777
- https://usn.ubuntu.com/4205-1/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html