The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sqlite: heap out-of-bound read in function rtreenode() (CVE-2019-8457)

  - The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows     remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL     command that triggers an API call with a crafted pointer value in the second argument. (CVE-2015-7036)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sqlite: Heap-buffer overflow in the getNodeSize function (CVE-2017-10989)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

  - The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service     (EXC_BAD_ACCESS and application crash) via a crafted file. (CVE-2017-13685)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3215-1 advisory.

  - SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows     context-dependent attackers to cause a denial of service (uninitialized memory access and application     crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by     COLLATE at the end of a SELECT statement. (CVE-2015-3414)

  - The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison     operators, which allows context-dependent attackers to cause a denial of service (invalid free operation)     or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a     CREATE TABLE statement. (CVE-2015-3415)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other     products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-     read or possibly unspecified other impact. (CVE-2017-10989)

  - An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is     affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the     SQLite component. It allows remote attackers to execute arbitrary code or cause a denial of service     (buffer overflow and application crash) via a crafted SQL statement. (CVE-2017-2518)

  - SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant     buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote     attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in     certain WebSQL use cases), aka Magellan. (CVE-2018-20346)

  - In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could     cause a NULL pointer dereference, related to build.c and prepare.c. (CVE-2018-8740)

  - In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application     because of missing validation of a sqlite_stat1 sz field, aka a severe division by zero in the query     planner. (CVE-2019-16168)

  - sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window     functions, and also has certain ORDER BY usage. (CVE-2019-19244)

  - lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated     column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
    (CVE-2019-19317)

  - SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application     crash. (CVE-2019-19603)

  - alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-     referential views in conjunction with ALTER TABLE statements. (CVE-2019-19645)

  - pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain     cases of generated columns. (CVE-2019-19646)

  - exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference     because constant integer values in ORDER BY clauses of window definitions are mishandled. (CVE-2019-19880)

  - flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT     JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect     results). (CVE-2019-19923)

  - SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This     is caused by incorrect sqlite3WindowRewrite() error handling. (CVE-2019-19924)

  - zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP     archive. (CVE-2019-19925)

  - multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by     errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2019-19880. (CVE-2019-19926)

  - ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving     embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for     example) valgrind. (CVE-2019-19959)

  - selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
    (CVE-2019-20218)

  - SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode()     function when handling invalid rtree tables. (CVE-2019-8457)

  - SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. (CVE-2020-13434)

  - SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. (CVE-2020-13435)

  - ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet     feature. (CVE-2020-13630)

  - SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related     to alter.c and build.c. (CVE-2020-13631)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query. (CVE-2020-13632)

  - In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy     heap overflow because of misuse of transitive properties for constant propagation. (CVE-2020-15358)

  - In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and     segmentation fault because of generated column optimizations. (CVE-2020-9327)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - SQLite3 from 3.6.0 to and including 3.27.2 is     vulnerable to heap out-of-bound read in the rtreenode()     function when handling invalid rtree     tables.(CVE-2019-8457)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sqlite package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4019-1 advisory.

    It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this     issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2518, CVE-2017-2520)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
    (CVE-2018-20505)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu     18.10. (CVE-2018-20346, CVE-2018-20506)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to access sensitive information. (CVE-2019-8457)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and     Ubuntu 18.10. (CVE-2019-9936)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS and Ubuntu 18.10. (CVE-2019-9937)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)

    It was discovered that SQLite incorrectly handled certain databases. An attacker could possibly use this     issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)

    It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue     to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2519)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for sqlite3 fixes the following issues :

Security issue fixed :

CVE-2019-8457: Fixed a Heap out-of-bound read in rtreenode() when handling invalid rtree tables (bsc#1136976).

CVE-2018-8740: Fixed a NULL pointer dereference related to corrupted databases schemas (bsc#1085790).

CVE-2017-10989: Fixed a heap-based buffer over-read in getNodeSize() (bsc#1132045).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 fixes the following issues :

Security issue fixed :

  - CVE-2018-8740: Fixed a NULL pointer dereference related     to corrupted databases schemas (bsc#1085790).

  - CVE-2017-10989: Fixed a heap-based buffer over-read in     getNodeSize() (bsc#1132045).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for sqlite3 fixes the following issues :

Security issue fixed :

CVE-2018-8740: Fixed a NULL pointer dereference related to corrupted databases schemas (bsc#1085790).

CVE-2017-10989: Fixed a heap-based buffer over-read in getNodeSize() (bsc#1132045).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iOS running on the mobile device is prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities as described in the HT208143 security advisory.

The remote host is running a version of macOS that is prior to 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Apache
 - AppSandbox
 - AppleScript
 - Application Firewall
 - ATS
 - Audio
 - CFNetwork
 - CFNetwork Proxies
 - CFString
 - Captive Network Assistant
 - CoreAudio
 - CoreText
 - DesktopServices
 - Directory Utility
 - file
 - Fonts
 - fsck_msdos
 - HFS
 - Heimdal
 - HelpViewer
 - IOFireWireFamily
 - ImageIO
 - Installer
 - Kernel
 - kext tools
 - libarchive
 - libc
 - libexpat
 - Mail
 - Mail Drafts
 - ntp
 - Open Scripting Architecture
 - PCRE
 - Postfix
 - Quick Look
 - QuickTime
 - Remote Management
 - SQLite
 - Sandbox
 - Screen Lock
 - Security
 - Spotlight
 - WebKit
 - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - os_unix.c in SQLite before 3.13.0 improperly implements     the temporary directory search algorithm, which might     allow local users to obtain sensitive information,     cause a denial of service (application crash), or have     unspecified other impact by leveraging use of the     current working directory for temporary     files.(CVE-2016-6153)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.i1/4^CVE-2017-10989i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the sqlite package has been released.

Several flaws were corrected in SQLite, a SQL database engine.

CVE-2017-2518

A use-after-free bug in the query optimizer may cause a buffer overflow and application crash via a crafted SQL statement.

CVE-2017-2519

Insufficient size of the reference count on Table objects could lead to a denial of service or arbitrary code execution.

CVE-2017-2520

The sqlite3_value_text() interface returned a buffer that was not large enough to hold the complete string plus zero terminator when the input was a zeroblob. This could lead to arbitrary code execution or a denial of service.

CVE-2017-10989

SQLite mishandles undersized RTree blobs in a crafted database leading to a heap-based buffer over-read or possibly unspecified other impact.

CVE-2018-8740

Databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference.

For Debian 8 'Jessie', these problems have been fixed in version 3.8.7.1-1+deb8u4.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, 10.12.x prior to 10.12.6, or is not macOS 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - AppSandbox
  - AppleScript
  - Application Firewall
  - ATS
  - Audio
  - CFNetwork
  - CFNetwork Proxies
  - CFString
  - Captive Network Assistant
  - CoreAudio
  - CoreText
  - DesktopServices
  - Directory Utility
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - IOFireWireFamily
  - ImageIO
  - Installer
  - Kernel
  - kext tools
  - libarchive
  - libc
  - libexpat
  - Mail
  - Mail Drafts
  - ntp
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - SQLite
  - Sandbox
  - Screen Lock
  - Security
  - Spotlight
  - WebKit
  - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Apple iOS running on the mobile device is prior to 11. It is, therefore, affected by multiple vulnerabilities as described in the HT208112 security advisory.

Google reports :

A heap-buffer overflow (sometimes a crash) can arise when running a SQL request on malformed sqlite3 databases.

Security fix for CVE-2017-10989: Heap-buffer overflow in the getNodeSize function

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-10989: Heap-buffer overflow in the getNodeSize function

Additionally sqlite has been updated to version 3.19.3, and spatialite-tools rebuilt for the update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a heap-based buffer over-read vulnerability in SQLite, a lightweight database engine. The getNodeSize function in ext/rtree/rtree.c mishandled undersized RTree blobs in a specially crafted database,

For Debian 7 'Wheezy', this issue has been fixed in sqlite3 version 3.7.13-1+deb7u4.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199469	RHEL 7 : sqlite (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199438	RHEL 6 : sqlite (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195680	RHEL 6 : sqlite (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
153643	SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2021:3215-1)	Nessus	SuSE Local Security Checks	critical
129253	EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2019-2060)	Nessus	Huawei Local Security Checks	critical
126848	EulerOS 2.0 SP2 : sqlite (EulerOS-SA-2019-1720)	Nessus	Huawei Local Security Checks	critical
126555	EulerOS Virtualization for ARM 64 3.0.2.0 : sqlite (EulerOS-SA-2019-1713)	Nessus	Huawei Local Security Checks	critical
126295	EulerOS 2.0 SP5 : sqlite (EulerOS-SA-2019-1668)	Nessus	Huawei Local Security Checks	critical
126065	Ubuntu 16.04 LTS / 18.04 LTS : SQLite vulnerabilities (USN-4019-1)	Nessus	Ubuntu Local Security Checks	critical
125986	SUSE SLES12 Security Update : sqlite3 (SUSE-SU-2019:1522-1)	Nessus	SuSE Local Security Checks	critical
125325	openSUSE Security Update : sqlite3 (openSUSE-2019-1426)	Nessus	SuSE Local Security Checks	critical
124856	SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2019:1208-1)	Nessus	SuSE Local Security Checks	critical
700542	Apple iOS < 11.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
700511	macOS < 10.13 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
123743	EulerOS Virtualization 2.5.3 : sqlite (EulerOS-SA-2019-1275)	Nessus	Huawei Local Security Checks	critical
121717	Photon OS 1.0: Sqlite PHSA-2017-0025	Nessus	PhotonOS Local Security Checks	critical
121133	Debian DLA-1633-1 : sqlite3 security update	Nessus	Debian Local Security Checks	critical
103598	macOS < 10.13 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
103420	Apple iOS < 11 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
102279	FreeBSD : sqlite3 -- heap-buffer overflow (9245681c-7c3c-11e7-b5af-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
101868	Fedora 24 : sqlite (2017-9b752904ed)	Nessus	Fedora Local Security Checks	critical
101776	Fedora 25 : sqlite (2017-447e926933)	Nessus	Fedora Local Security Checks	critical
101607	Fedora 26 : spatialite-tools / sqlite (2017-357f9df699)	Nessus	Fedora Local Security Checks	critical
101319	Debian DLA-1018-1 : sqlite3 security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-10989

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical