CVE-2019-8457

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
checkpointCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
VendorProductVersion
sqlitesqlite
3.6.0 ≤
𝑥
≤ 3.27.2
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
canonicalubuntu_linux
19.04
opensuseleap
42.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
db5.3
bullseye
ignored
buster
ignored
stretch
ignored
jessie
ignored
bookworm
5.3.28+dfsg2-1
fixed
sid
5.3.28+dfsg2-9
fixed
trixie
5.3.28+dfsg2-9
fixed
sqlite3
bullseye
3.34.1-3
ignored
buster
ignored
stretch
ignored
jessie
ignored
bullseye (security)
3.34.1-3+deb11u1
fixed
bookworm
3.40.1-2
fixed
sid
3.46.1-1
fixed
trixie
3.46.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium
noble
dne
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
dne
hirsute
dne
groovy
dne
focal
dne
eoan
dne
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
db5.3
noble
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
mantic
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
lunar
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
kinetic
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
jammy
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
impish
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
hirsute
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
groovy
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
focal
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
eoan
Fixed 5.3.28+dfsg1-0.6ubuntu1
released
disco
Fixed 5.3.28+dfsg1-0.5ubuntu0.1
released
cosmic
Fixed 5.3.28+dfsg1-0.1ubuntu0.1
released
bionic
Fixed 5.3.28-13.1ubuntu1.1
released
xenial
Fixed 5.3.28-11ubuntu0.2
released
trusty
Fixed 5.3.28-3ubuntu3.1+esm1
released
qtwebengine-opensource-src
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
groovy
ignored
focal
needs-triage
eoan
ignored
disco
ignored
cosmic
ignored
bionic
needs-triage
xenial
dne
trusty
dne
sqlcipher
noble
needed
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needed
impish
ignored
hirsute
ignored
groovy
ignored
focal
needed
eoan
ignored
disco
ignored
cosmic
ignored
bionic
needed
xenial
needed
trusty
dne
sqlite3
noble
Fixed 3.27.2-3
released
mantic
Fixed 3.27.2-3
released
lunar
Fixed 3.27.2-3
released
kinetic
Fixed 3.27.2-3
released
jammy
Fixed 3.27.2-3
released
impish
Fixed 3.27.2-3
released
hirsute
Fixed 3.27.2-3
released
groovy
Fixed 3.27.2-3
released
focal
Fixed 3.27.2-3
released
eoan
Fixed 3.27.2-3
released
disco
Fixed 3.27.2-2ubuntu0.1
released
cosmic
Fixed 3.24.0-1ubuntu0.1
released
bionic
Fixed 3.22.0-1ubuntu0.1
released
xenial
Fixed 3.11.0-1ubuntu1.2
released
trusty
Fixed 3.8.2-1ubuntu2.2+esm1
released
References