CVE-2019-16168

Description

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

CVSS breakdown

Affected products

• Canonical / Ubuntu Linux19.10 – 19.10
• Canonical / Ubuntu Linux18.04 – 18.04
• Canonical / Ubuntu Linux16.04 – 16.04
• Canonical / Ubuntu Linux12.04 – 12.04
• Canonical / Ubuntu Linux19.04 – 19.04
• Debian / debian_linux9.0 – 9.0
• fedoraproject / fedora30 – 30
• McAfee / policy_auditor6.5.1
• NetApp / active_iq_unified_manager7.3 –
• NetApp / active_iq_unified_manager9.5 –
• NetApp / e-series_santricity_os_controller11.0.0 – 11.60.3
• NetApp / OnCommand Insight
• NetApp / OnCommand Workflow Automation
• NetApp / ONTAP Select Deploy administration utility
• NetApp / santricity_unified_manager
• NetApp / steelstore_cloud_integrated_storage
• oracle / communications_design_studio7.3.4.3.0 – 7.3.4.3.0
• oracle / communications_design_studio7.3.5.5.0 – 7.3.5.5.0
• oracle / communications_design_studio7.4.0.4.0 – 7.4.0.4.0
• oracle / jdk1.8.0 – 1.8.0
• oracle / jre1.8.0 – 1.8.0
• oracle / mysql8.0.0 – 8.0.18
• oracle / outside_in_technology8.5.4 – 8.5.4
• oracle / solaris11 – 11
• oracle / zfs_storage_appliance8.8 – 8.8
• SQLite / SQLite3.8.5 – 3.29.0
• tenable / Nessus Agent8.2.3

References

• MAILING_LISThttps://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html
• MISChttps://www.sqlite.org/src/timeline?c=98357d8c1263920b
• MISChttps://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62
• MISChttps://security.netapp.com/advisory/ntap-20190926-0003/
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html
• VENDOR_ADVISORYhttps://usn.ubuntu.com/4205-1/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2020.html
• MISChttps://security.netapp.com/advisory/ntap-20200122-0003/
• MISChttps://security.gentoo.org/glsa/202003-16
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2020.html
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
• MISChttps://www.tenable.com/security/tns-2021-08
• MISChttps://www.tenable.com/security/tns-2021-11
• MISChttps://www.tenable.com/security/tns-2021-14
• MISChttps://kc.mcafee.com/corporate/index?page=content&id=SB10365