CVE-2019-19959: SQL Injection
ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
Other sources
SQLite is vulnerable to a denial of service, caused by the mishandling of certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames. By using a specially-crafted filename, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-19959?
CVE-2019-19959 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service condition by using a specially-crafted filename.
How does CVE-2019-19959 affect IBM Data Risk Manager 2.0.6?
IBM Data Risk Manager 2.0.6 is affected by CVE-2019-19959. Users should apply the patch provided by IBM to fix the vulnerability.
Is SQLite 3.30.1 vulnerable to CVE-2019-19959?
Yes, SQLite 3.30.1 is vulnerable to CVE-2019-19959.
How can I fix the CVE-2019-19959 vulnerability in Ubuntu Linux 16.04?
To fix the CVE-2019-19959 vulnerability in Ubuntu Linux 16.04, update the sqlite3 package to version 3.22.0-1ubuntu0.3 or later.
What is the severity of CVE-2019-19959?
CVE-2019-19959 has a severity rating of 7.5 (high).