CVE-2019-19880

Опубликовано: 18 дек. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0514
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200114-0001/
Third Party Advisory
https://usn.ubuntu.com/4298-1/
Broken Link
https://www.debian.org/security/2020/dsa-4638
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0514
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200114-0001/
Third Party Advisory
https://usn.ubuntu.com/4298-1/
Broken Link
https://www.debian.org/security/2020/dsa-4638
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sqlite:sqlite:3.30.1:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 7

cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*

Версия до 8.0.19 (включая)

Конфигурация 8

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Версия до 1.0.1.1 (исключая)

EPSS

Процентиль: 91%

0.06395

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-476

Связанные уязвимости

CVE-2019-19880

CVSS3: 7.5

ubuntu

около 6 лет назад

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

CVE-2019-19880

CVSS3: 7.5

redhat

около 6 лет назад

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

CVE-2019-19880

CVSS3: 7.5

debian

около 6 лет назад

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to tr ...

GHSA-mpvh-7x64-2fc7

CVSS3: 7.5

github

больше 3 лет назад

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

BDU:2020-00404

CVSS3: 7.5

fstec

около 6 лет назад

Уязвимость функции exprListAppendList () системы управления базами данных SQLite, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 91%

0.06395

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-476