7.5Alta
CVE-2019-9936
Descripción
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.
Debilidad (CWE):
CWE-125
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.0 – < V3.1.5 | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.0 – < V3.1.5 | |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | V3.1.0 – < V3.1.5 | |
| sqlite | sqlite | 3.27.2 |
Referencias y parches
- https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html
- https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html
- https://sqlite.org/src/info/b3fa58dd7403dbd4 PatchVendor Advisory
- 107562 vdb-entryThird Party AdvisoryVDB Entry
- https://security.netapp.com/advisory/ntap-20190416-0005/ Third Party Advisory
- openSUSE-SU-2019:1372 vendor-advisory
- FEDORA-2019-8641591b3c vendor-advisory
- FEDORA-2019-a01751837d vendor-advisory
- USN-4019-1 vendor-advisory
- GLSA-201908-09 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2340-1] sqlite3 security update mailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Coincidencias CPE (NVD) (1)
cpe:2.3:a:sqlite:sqlite:3.27.2:*:*:*:*:*:*:*