CVE-2019-19880
Published: 18 December 2019
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Priority
CVSS 3 base score: 7.5
Status
Package | Release | Status |
---|---|---|
sqlite3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(3.22.0-1ubuntu0.2)
|
disco |
Ignored
(reached end-of-life)
|
|
eoan |
Released
(3.29.0-2ubuntu0.2)
|
|
precise |
Not vulnerable
|
|
trusty |
Not vulnerable
|
|
upstream |
Needs triage
|
|
xenial |
Not vulnerable
(3.11.0-1ubuntu1.3)
|
|
Patches: upstream: https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54 |
Notes
Author | Note |
---|---|
mdeslaur | introduced in 3.29.0 see CVE-2019-19926 for incomplete fix for this CVE |