CVE-2019-19880
Published: 18 December 2019
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Priority
Medium
CVSS 3 base score: 7.5
Status
| Package | Release | Status |
|---|---|---|
|
sqlite3 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Not vulnerable
(3.22.0-1ubuntu0.2)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Not vulnerable
(3.11.0-1ubuntu1.3)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Not vulnerable
|
|
|
Patches: Upstream: https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54 |
||
Notes
| Author | Note |
|---|---|
| mdeslaur | introduced in 3.29.0 see CVE-2019-19926 for incomplete fix for this CVE |