CVE-2019-16168

Published Sep 9, 2019

Last updated 10 days ago

Overview

Description
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Source
cve@mitre.org
NVD status
Modified
Products
sqlite, active_iq_unified_manager, e-series_santricity_os_controller, oncommand_insight, oncommand_workflow_automation, ontap_select_deploy_administration_utility, santricity_unified_manager, steelstore_cloud_integrated_storage, ubuntu_linux, fedora, debian_linux, nessus_agent, communications_design_studio, jdk, jre, mysql, outside_in_technology, solaris, zfs_storage_appliance, policy_auditor

Risk scores

CVSS 3.1

Type
Primary
Base score
6.5
Impact score
3.6
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
4.3
Impact score
2.9
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:N/I:N/A:P

Weaknesses

nvd@nist.gov
CWE-369
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-369

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.