CVE-2019-16168: SQL Injection
In SQLite through 3.29.0 whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlitestat1 sz field aka a "severe division by zero in the query planner."
Other sources
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlitestat1 sz field, aka a "severe division by zero in the query planner."
— Launchpad
SQLite is vulnerable to a denial of service, caused by missing validation of a sqlitestat1 sz field in whereLoopAddBtreeIndex in sqlite3.c. By providing specially-crafted input, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.34.1-3Fixed in 3.34.1-3+deb11u1Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u1Fixed in 3.46.1-9Fixed in 3.53.3-1 - Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.29.0Patch severe division by zero in the query planner - Compensating control
Mitigate the denial-of-service risk by preventing untrusted/specially-crafted SQLite inputs from reaching SQLite instances that may exercise whereLoopAddBtreeIndex (sqlite3.c) until the vulnerability is fixed.
Event History
Frequently Asked Questions
What is CVE-2019-16168?
CVE-2019-16168 is a vulnerability in SQLite that can cause a denial of service by crashing an application.
How does CVE-2019-16168 affect SQLite?
CVE-2019-16168 affects SQLite versions up to 3.29.0 and can be exploited by providing specially-crafted input.
How severe is CVE-2019-16168?
CVE-2019-16168 has a severity rating of 6.5, which is considered medium.
Which software versions are affected by CVE-2019-16168?
SQLite versions up to 3.29.0 are affected by CVE-2019-16168.
Is there a fix available for CVE-2019-16168?
Yes, the vulnerability can be fixed by updating SQLite to version 3.29.0 or higher.