CVE-2019-19880
Published: 18 December 2019
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Priority
Medium
CVSS 3 base score: 7.5
Status
| Package | Release | Status |
|---|---|---|
|
sqlite3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(3.22.0-1ubuntu0.2)
|
| disco |
Ignored
(reached end-of-life)
|
|
| eoan |
Released
(3.29.0-2ubuntu0.2)
|
|
| precise |
Not vulnerable
|
|
| trusty |
Not vulnerable
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(3.11.0-1ubuntu1.3)
|
|
|
Patches: upstream: https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54 |
||
Notes
| Author | Note |
|---|---|
| mdeslaur | introduced in 3.29.0 see CVE-2019-19926 for incomplete fix for this CVE |