CVE-2016-6153

os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 9%
Affected Products (NVD)
VendorProductVersion
sqlitesqlite
𝑥
≤ 3.12.2
opensuseleap
42.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
sqlite3
bookworm
3.40.1-2
fixed
bullseye
3.34.1-3
fixed
bullseye (security)
3.34.1-3+deb11u1
fixed
sid
3.46.1-1
fixed
trixie
3.46.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sqlite
artful
ignored
bionic
not-affected
cosmic
not-affected
disco
not-affected
precise
ignored
trusty
not-affected
wily
ignored
xenial
not-affected
yakkety
ignored
zesty
ignored
sqlite3
artful
not-affected
bionic
not-affected
cosmic
not-affected
disco
not-affected
precise
ignored
trusty
Fixed 3.8.2-1ubuntu2.2+esm1
released
wily
ignored
xenial
Fixed 3.11.0-1ubuntu1.2
released
yakkety
not-affected
zesty
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libsqlite3-0
suse enterprise sap 12 SP1
3.8.10.2-3.1
fixed
suse enterprise sap 12 SP5
3.36.0-9.18.1
fixed
suse enterprise server 12
3.8.3.1-2.7.1
fixed
suse enterprise server 12 SP1
3.8.10.2-3.1
fixed
suse enterprise server 12 SP2
3.36.0-9.18.1
fixed
suse enterprise server 12 SP3
3.8.10.2-8.1
fixed
suse enterprise server 12 SP4
3.8.10.2-8.1
fixed
suse enterprise server 12 SP5
3.36.0-9.18.1
fixed
libsqlite3-0-32bit
suse enterprise sap 12 SP1
3.8.10.2-3.1
fixed
suse enterprise sap 12 SP5
3.36.0-9.18.1
fixed
suse enterprise server 12
3.8.3.1-2.7.1
fixed
suse enterprise server 12 SP1
3.8.10.2-3.1
fixed
suse enterprise server 12 SP2
3.36.0-9.18.1
fixed
suse enterprise server 12 SP3
3.8.10.2-8.1
fixed
suse enterprise server 12 SP4
3.8.10.2-8.1
fixed
suse enterprise server 12 SP5
3.36.0-9.18.1
fixed
sqlite3
suse enterprise sap 12 SP1
3.8.10.2-3.1
fixed
suse enterprise sap 12 SP5
3.36.0-9.18.1
fixed
suse enterprise server 12
3.8.3.1-2.7.1
fixed
suse enterprise server 12 SP1
3.8.10.2-3.1
fixed
suse enterprise server 12 SP2
3.36.0-9.18.1
fixed
suse enterprise server 12 SP3
3.8.10.2-8.1
fixed
suse enterprise server 12 SP4
3.8.10.2-8.1
fixed
suse enterprise server 12 SP5
3.36.0-9.18.1
fixed
sqlite3-devel
suse enterprise sap 12 SP5
3.36.0-9.18.1
fixed
suse enterprise server 12 SP2
3.36.0-9.18.1
fixed
suse enterprise server 12 SP3
3.36.0-9.18.1
fixed
suse enterprise server 12 SP4
3.36.0-9.18.1
fixed
suse enterprise server 12 SP5
3.36.0-9.18.1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-updates/2016-08/msg00053.html
http://www.openwall.com/lists/oss-security/2016/07/01/1
http://www.openwall.com/lists/oss-security/2016/07/01/2
http://www.securityfocus.com/bid/91546
http://www.sqlite.org/cgi/src/info/67985761aa93fb61
https://lists.debian.org/debian-lts-announce/2023/05/msg00022.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGQTH7V45QVHFDXJAEECHEO3HHD644WZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
https://usn.ubuntu.com/4019-1/
https://usn.ubuntu.com/4019-2/
https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt
https://www.sqlite.org/releaselog/3_13_0.html
https://www.tenable.com/security/tns-2016-20
http://lists.opensuse.org/opensuse-updates/2016-08/msg00053.html
http://www.openwall.com/lists/oss-security/2016/07/01/1
http://www.openwall.com/lists/oss-security/2016/07/01/2
http://www.securityfocus.com/bid/91546
http://www.sqlite.org/cgi/src/info/67985761aa93fb61
https://lists.debian.org/debian-lts-announce/2023/05/msg00022.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGQTH7V45QVHFDXJAEECHEO3HHD644WZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
https://usn.ubuntu.com/4019-1/
https://usn.ubuntu.com/4019-2/
https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt
https://www.sqlite.org/releaselog/3_13_0.html
https://www.tenable.com/security/tns-2016-20