CVE-2019-19880: SQL Injection
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Other sources
SQLite is vulnerable to a denial of service, caused by an invalid pointer dereference in exprListAppendList in window.c. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-19880?
CVE-2019-19880 is a vulnerability in SQLite that allows attackers to trigger an invalid pointer dereference, leading to a denial of service.
How severe is CVE-2019-19880?
CVE-2019-19880 has a severity score of 7.5 out of 10, indicating a high severity.
Which software products are affected by CVE-2019-19880?
IBM Data Risk Manager, Debian, Chromium, SQLite, SQLite3, Netapp Cloud Backup, Suse Package Hub, SUSE Linux Enterprise, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, openSUSE Backports SLE, openSUSE Leap, Oracle MySQL Workbench, Siemens Sinec Infrastructure Network Services, and Ubuntu.
How can I fix CVE-2019-19880 in IBM Data Risk Manager?
To fix CVE-2019-19880 in IBM Data Risk Manager, update to version 2.0.6 or later. Apply the patch provided by IBM: [IBM Security Fix Central](https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Data+Risk+Manager&release=2.0.4.1&platform=Linux&function=all)
How can I fix CVE-2019-19880 in Debian?
To fix CVE-2019-19880 in Debian, update the 'sqlite' or 'sqlite3' package to the latest version available. Check the Debian security advisory for detailed information.