CVE-2019-19925: SQL Injection
Last updated 25 August 2025
Other sources
SQLite is vulnerable to a denial of service, caused by the mishandling of a NULL pathname in the zipfileUpdate function in ext/misc/zipfile.c. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 120.0.6099.224-1~deb11u1Fixed in 150.0.7871.100-1~deb12u1Fixed in 150.0.7871.124-1~deb12u1Fixed in 150.0.7871.100-1~deb13u1Fixed in 150.0.7871.114-1~deb13u1Fixed in 150.0.7871.114-1Fixed in 150.0.7871.124-1 - Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.34.1-3Fixed in 3.34.1-3+deb11u1Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u1Fixed in 3.46.1-9Fixed in 3.53.3-1 - Upgrade
Upgrade
sqlite/sqliteto a version that resolves this vulnerability.Fixed in 3.30.1 - Compensating control
Mitigate the denial-of-service by preventing processing of ZIP updates that could reach zipfileUpdate in ext/misc/zipfile.c (e.g., validate/avoid NULL pathname conditions before ZIP update handling).
Event History
Frequently Asked Questions
What is CVE-2019-19925?
CVE-2019-19925 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service by exploiting a mishandling of a NULL pathname.
What is the severity of CVE-2019-19925?
CVE-2019-19925 has a severity rating of 7.5 (high).
How does CVE-2019-19925 affect IBM Data Risk Manager?
IBM Data Risk Manager version 2.0.6 is affected by CVE-2019-19925.
How can I fix CVE-2019-19925 in SQLite?
Apply the patch provided by SQLite or upgrade to a version that has fixed the vulnerability.
Where can I find more information about CVE-2019-19925?
You can find more information about CVE-2019-19925 in the references provided: [link1], [link2], [link3].