CVE-2019-13750: SQL Injection
An insufficient data validation flaw was found in the SQLite component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1025464
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
Other sources
Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 79.0.3945.79 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 120.0.6099.224-1~deb11u1Fixed in 150.0.7871.100-1~deb12u1Fixed in 150.0.7871.124-1~deb12u1Fixed in 150.0.7871.100-1~deb13u1Fixed in 150.0.7871.114-1~deb13u1Fixed in 150.0.7871.114-1Fixed in 150.0.7871.124-1 - Upgrade
Upgrade
Chromium/Google Chrome (SQLite component)to a version that resolves this vulnerability.Fixed in 79.0.3945.79
Event History
Frequently Asked Questions
What is CVE-2019-13750?
CVE-2019-13750 is a vulnerability in SQLite in Google Chrome prior to version 79.0.3945.79 that allows a remote attacker to bypass defense-in-depth measures via a crafted HTML page.
How severe is CVE-2019-13750?
CVE-2019-13750 has a severity rating of 6.5, which is considered medium.
Which software versions are affected by CVE-2019-13750?
CVE-2019-13750 affects Google Chrome prior to version 79.0.3945.79, Redhat Chromium Browser 79.0.3945.79, Debian Linux 9.0 and 10.0, Fedora 30 and 31, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux For Scientific Computing, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Canonical Ubuntu Linux 14.04, 16.04, 18.04, and 19.10.
How can I fix CVE-2019-13750?
To fix CVE-2019-13750, you should update Google Chrome to version 79.0.3945.79 or later, or install the appropriate security updates for the affected software versions.
Where can I find more information about CVE-2019-13750?
You can find more information about CVE-2019-13750 on the Debian security tracker, Chromium issue tracker, and the Google Chrome release blog.