CVE-2019-19880

EUVD-2019-9473
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
sqlitesqlite
3.30.1
netappcloud_backup
-
debiandebian_linux
9.0
debiandebian_linux
10.0
susepackage_hub
-
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_workstation
6.0
opensusebackports_sle
15.0:sp1
opensuseleap
15.1
oraclemysql_workbench
𝑥
≤ 8.0.19
siemenssinec_infrastructure_network_services
𝑥
< 1.0.1.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
chromium
bookworm
128.0.6613.84-1~deb12u1
fixed
bookworm (security)
130.0.6723.91-1~deb12u1
fixed
bullseye
120.0.6099.224-1~deb11u1
fixed
bullseye (security)
120.0.6099.224-1~deb11u1
fixed
buster
not-affected
jessie
not-affected
sid
130.0.6723.91-2
fixed
stretch
not-affected
trixie
129.0.6668.89-1
fixed
sqlite3
bookworm
3.40.1-2
fixed
bullseye
3.34.1-3
fixed
bullseye (security)
3.34.1-3+deb11u1
fixed
buster
not-affected
jessie
not-affected
sid
3.46.1-1
fixed
stretch
not-affected
trixie
3.46.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sqlite3
bionic
not-affected
disco
ignored
eoan
Fixed 3.29.0-2ubuntu0.2
released
trusty
not-affected
xenial
not-affected