CVE-2019-16168

Published: 09 September 2019

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

Priority

CVSS 3 base score: 6.5

Status

Package	Release	Status
sqlite3 Launchpad, Ubuntu, Debian	Upstream	Released (3.29.0-2)




	Ubuntu 18.04 LTS (Bionic Beaver)	Released (3.22.0-1ubuntu0.2)
	Ubuntu 16.04 ESM (Xenial Xerus)	Released (3.11.0-1ubuntu1.3)
	Ubuntu 14.04 ESM (Trusty Tahr)	Not vulnerable (code not present)
	Patches: Upstream: https://www.sqlite.org/src/info/d93508fc9913cfe6 Upstream: https://www.sqlite.org/src/timeline?c=98357d8c1263920b

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16168
https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg116312.html
https://ubuntu.com/security/notices/USN-4205-1
NVD
Launchpad
Debian

Bugs

https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›