CVE-2019-19925

Опубликовано: 24 дек. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0514
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://github.com/sqlite/sqlite/commit/54d501092d88c0cf89bec4279951f548fb0b8618
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200114-0003/
Third Party Advisory
https://usn.ubuntu.com/4298-1/
Broken Link
https://www.debian.org/security/2020/dsa-4638
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0514
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://github.com/sqlite/sqlite/commit/54d501092d88c0cf89bec4279951f548fb0b8618
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200114-0003/
Third Party Advisory
https://usn.ubuntu.com/4298-1/
Broken Link
https://www.debian.org/security/2020/dsa-4638
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sqlite:sqlite:3.30.1:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Версия до 1.0.1.1 (исключая)

Конфигурация 3

cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*

Версия до 8.0.19 (включая)

Конфигурация 4

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

Конфигурация 7

Одно из

cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 8

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01046

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

CVE-2019-19925

CVSS3: 7.5

ubuntu

около 6 лет назад

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

CVE-2019-19925

CVSS3: 7.5

redhat

около 6 лет назад

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

CVE-2019-19925

CVSS3: 7.5

debian

около 6 лет назад

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL ...

GHSA-wcjr-83cc-7pfq

CVSS3: 7.5

github

больше 3 лет назад

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

BDU:2020-01748

CVSS3: 7.5

fstec

около 6 лет назад

Уязвимость функции zipfileUpdate() системы управления базами данных SQLite, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 77%

0.01046

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-434