sqlite CVEs · Critical

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2020-35527	Critical	2022-09-01	Not applicable	No public exploit	In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.
CVE-2020-11656	Critical	2020-04-09	Outside Waratek scope	No public exploit	In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2019-19646	Critical	2019-12-09	Outside Waratek scope	No public exploit	pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
CVE-2019-19317	Critical	2019-12-05	Not applicable	No public exploit	lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVE-2019-8457	Critical	2019-05-30	Not applicable	No public exploit	SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
CVE-2017-10989	Critical	2017-07-07	Not applicable	No public exploit	The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2020-35527

Critical

2022-09-01

Not applicable

No public exploit

In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

CVE-2020-11656

Critical

2020-04-09

Outside Waratek scope

No public exploit

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

CVE-2019-19646

Critical

2019-12-09

Outside Waratek scope

No public exploit

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

CVE-2019-19317

Critical

2019-12-05

Not applicable

No public exploit

lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.

CVE-2019-8457

Critical

2019-05-30

Not applicable

No public exploit

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

CVE-2017-10989

Critical

2017-07-07

Not applicable

No public exploit

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.