CVE-2019-13752: SQL Injection
An out of bounds read flaw was found in the SQLite component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1025470
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
Other sources
Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 79.0.3945.79 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 120.0.6099.224-1~deb11u1Fixed in 150.0.7871.100-1~deb12u1Fixed in 150.0.7871.124-1~deb12u1Fixed in 150.0.7871.100-1~deb13u1Fixed in 150.0.7871.114-1~deb13u1Fixed in 150.0.7871.114-1Fixed in 150.0.7871.124-1 - Upgrade
Upgrade
chromium/google chrome (SQLite component)to a version that resolves this vulnerability.Fixed in 79.0.3945.79 - Compensating control
Until upgraded, restrict access to untrusted websites/HTML content so attackers cannot reach the vulnerable parsing path that triggers the SQLite out-of-bounds read in Google Chrome prior to 79.0.3945.79.
Event History
Frequently Asked Questions
What is CVE-2019-13752?
CVE-2019-13752 is an out of bounds read vulnerability in SQLite in Google Chrome prior to version 79.0.3945.79.
How does CVE-2019-13752 work?
CVE-2019-13752 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
What is the severity of CVE-2019-13752?
CVE-2019-13752 has a severity rating of 6.5 (medium).
How do I fix CVE-2019-13752?
To fix CVE-2019-13752, update Google Chrome to version 79.0.3945.79 or later.
Where can I find more information about CVE-2019-13752?
You can find more information about CVE-2019-13752 at the following references: [link1] [link2] [link3].