CVE-2019-16168: SQL Injection
In SQLite through 3.29.0 whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlitestat1 sz field aka a "severe division by zero in the query planner."
Other sources
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlitestat1 sz field, aka a "severe division by zero in the query planner."
— Launchpad
SQLite is vulnerable to a denial of service, caused by missing validation of a sqlitestat1 sz field in whereLoopAddBtreeIndex in sqlite3.c. By providing specially-crafted input, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-16168?
CVE-2019-16168 is a vulnerability in SQLite that can cause a denial of service by crashing an application.
How does CVE-2019-16168 affect SQLite?
CVE-2019-16168 affects SQLite versions up to 3.29.0 and can be exploited by providing specially-crafted input.
How severe is CVE-2019-16168?
CVE-2019-16168 has a severity rating of 6.5, which is considered medium.
Which software versions are affected by CVE-2019-16168?
SQLite versions up to 3.29.0 are affected by CVE-2019-16168.
Is there a fix available for CVE-2019-16168?
Yes, the vulnerability can be fixed by updating SQLite to version 3.29.0 or higher.