In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

An update of the sqlite package has been released.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sqlite: heap out-of-bound read in function rtreenode() (CVE-2019-8457)

  - The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows     remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL     command that triggers an API call with a crafted pointer value in the second argument. (CVE-2015-7036)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3431 advisory.

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

  - In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could     cause a NULL pointer dereference, related to build.c and prepare.c. (CVE-2018-8740)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3215-1 advisory.

  - SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows     context-dependent attackers to cause a denial of service (uninitialized memory access and application     crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by     COLLATE at the end of a SELECT statement. (CVE-2015-3414)

  - The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison     operators, which allows context-dependent attackers to cause a denial of service (invalid free operation)     or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a     CREATE TABLE statement. (CVE-2015-3415)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other     products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-     read or possibly unspecified other impact. (CVE-2017-10989)

  - An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is     affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the     SQLite component. It allows remote attackers to execute arbitrary code or cause a denial of service     (buffer overflow and application crash) via a crafted SQL statement. (CVE-2017-2518)

  - SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant     buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote     attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in     certain WebSQL use cases), aka Magellan. (CVE-2018-20346)

  - In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could     cause a NULL pointer dereference, related to build.c and prepare.c. (CVE-2018-8740)

  - In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application     because of missing validation of a sqlite_stat1 sz field, aka a severe division by zero in the query     planner. (CVE-2019-16168)

  - sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window     functions, and also has certain ORDER BY usage. (CVE-2019-19244)

  - lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated     column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
    (CVE-2019-19317)

  - SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application     crash. (CVE-2019-19603)

  - alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-     referential views in conjunction with ALTER TABLE statements. (CVE-2019-19645)

  - pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain     cases of generated columns. (CVE-2019-19646)

  - exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference     because constant integer values in ORDER BY clauses of window definitions are mishandled. (CVE-2019-19880)

  - flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT     JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect     results). (CVE-2019-19923)

  - SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This     is caused by incorrect sqlite3WindowRewrite() error handling. (CVE-2019-19924)

  - zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP     archive. (CVE-2019-19925)

  - multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by     errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2019-19880. (CVE-2019-19926)

  - ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving     embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for     example) valgrind. (CVE-2019-19959)

  - selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
    (CVE-2019-20218)

  - SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode()     function when handling invalid rtree tables. (CVE-2019-8457)

  - SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. (CVE-2020-13434)

  - SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. (CVE-2020-13435)

  - ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet     feature. (CVE-2020-13630)

  - SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related     to alter.c and build.c. (CVE-2020-13631)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query. (CVE-2020-13632)

  - In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy     heap overflow because of misuse of transitive properties for constant propagation. (CVE-2020-15358)

  - In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and     segmentation fault because of generated column optimizations. (CVE-2020-9327)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4394-1 advisory.

    It was discovered that SQLite incorrectly handled certain corruped schemas. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-8740)

    It was discovered that SQLite incorrectly handled certain SELECT statements. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10.
    (CVE-2019-19603)

    It was discovered that SQLite incorrectly handled certain self-referential views. An attacker could     possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10.
    (CVE-2019-19645)

    Henry Liu discovered that SQLite incorrectly handled certain malformed window-function queries. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 19.10     and Ubuntu 20.04 LTS. (CVE-2020-11655)

    It was discovered that SQLite incorrectly handled certain string operations. An attacker could use this     issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13434)

    It was discovered that SQLite incorrectly handled certain expressions. An attacker could use this issue to     cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue     only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-13435)

    It was discovered that SQLite incorrectly handled certain fts3 queries. An attacker could use this issue     to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13630)

    It was discovered that SQLite incorrectly handled certain virtual table names. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10 and Ubuntu     20.04 LTS. (CVE-2020-13631)

    It was discovered that SQLite incorrectly handled certain fts3 queries. An attacker could use this issue     to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13632)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4205-1 advisory.

    It was discovered that SQLite incorrectly handled certain schemas. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM. (CVE-2018-8740)

    It was discovered that SQLite incorrectly handled certain schemas. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu     19.04. (CVE-2019-16168)

    It was discovered that SQLite incorrectly handled certain schemas. An attacker could possibly use this     issue to mishandles some expressions. This issue only affected Ubuntu 19.04 and Ubuntu 19.10.
    (CVE-2019-19242)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-19244)

    It was discovered that SQLite incorrectly handled certain SQL commands. An attacker could possibly use     this issue to execute arbitrary code. This issue only affected Ubuntu 19.04. (CVE-2019-5018)

    It was discovered that SQLite incorrectly handled certain commands. An attacker could possibly use this     issue to execute arbitrary code. (CVE-2019-5827)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for sqlite3 fixes the following issues :

Security issue fixed :

CVE-2019-8457: Fixed a Heap out-of-bound read in rtreenode() when handling invalid rtree tables (bsc#1136976).

CVE-2018-8740: Fixed a NULL pointer dereference related to corrupted databases schemas (bsc#1085790).

CVE-2017-10989: Fixed a heap-based buffer over-read in getNodeSize() (bsc#1132045).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 fixes the following issues :

Security issue fixed :

  - CVE-2018-8740: Fixed a NULL pointer dereference related     to corrupted databases schemas (bsc#1085790).

  - CVE-2017-10989: Fixed a heap-based buffer over-read in     getNodeSize() (bsc#1132045).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that SQLite's sqlite3VdbeExec() function     did not properly implement comparison operators. A     local attacker could submit a specially crafted CHECK     statement that would crash the SQLite process, or have     other unspecified impacts.(CVE-2015-3415)

  - A flaw was found in the way SQLite handled dequoting of     collation-sequence names. A local attacker could submit     a specially crafted COLLATE statement that would crash     the SQLite process, or have other unspecified     impacts.(CVE-2015-3414)

  - A NULL pointer dereference vulnerability was found in     SQLite. Loading a database whose schema was corrupted     using a CREATE TABLE AS statement would result in a     SQLite crash.(CVE-2018-8740)

  - It was found that SQLite's sqlite3VXPrintf() function     did not properly handle precision and width values     during floating-point conversions. A local attacker     could submit a specially crafted SELECT statement that     would crash the SQLite process, or have other     unspecified impacts.(CVE-2015-3416)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 fixes the following issues :

Security issue fixed :

CVE-2018-8740: Fixed a NULL pointer dereference related to corrupted databases schemas (bsc#1085790).

CVE-2017-10989: Fixed a heap-based buffer over-read in getNodeSize() (bsc#1132045).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several flaws were corrected in SQLite, a SQL database engine.

CVE-2017-2518

A use-after-free bug in the query optimizer may cause a buffer overflow and application crash via a crafted SQL statement.

CVE-2017-2519

Insufficient size of the reference count on Table objects could lead to a denial of service or arbitrary code execution.

CVE-2017-2520

The sqlite3_value_text() interface returned a buffer that was not large enough to hold the complete string plus zero terminator when the input was a zeroblob. This could lead to arbitrary code execution or a denial of service.

CVE-2017-10989

SQLite mishandles undersized RTree blobs in a crafted database leading to a heap-based buffer over-read or possibly unspecified other impact.

CVE-2018-8740

Databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference.

For Debian 8 'Jessie', these problems have been fixed in version 3.8.7.1-1+deb8u4.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-8740

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In SQLite through 3.22.0, databases whose schema is     corrupted using a CREATE TABLE AS statement could cause     a NULL pointer dereference, related to build.c and     prepare.c.(CVE-2018-8740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

SQLite databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In SQLite through 3.22.0, databases whose schema is     corrupted using a CREATE TABLE AS statement could cause     a NULL pointer dereference, related to build.c and     prepare.c.(CVE-2018-8740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203056	Photon OS 2.0: Sqlite PHSA-2018-2.0-0037	Nessus	PhotonOS Local Security Checks	high
199469	RHEL 7 : sqlite (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
176213	Debian DLA-3431-1 : sqlite - LTS security update	Nessus	Debian Local Security Checks	medium
153643	SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2021:3215-1)	Nessus	SuSE Local Security Checks	critical
137353	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : SQLite vulnerabilities (USN-4394-1)	Nessus	Ubuntu Local Security Checks	high
131561	Ubuntu 16.04 LTS / 18.04 LTS : SQLite vulnerabilities (USN-4205-1)	Nessus	Ubuntu Local Security Checks	high
125986	SUSE SLES12 Security Update : sqlite3 (SUSE-SU-2019:1522-1)	Nessus	SuSE Local Security Checks	critical
125325	openSUSE Security Update : sqlite3 (openSUSE-2019-1426)	Nessus	SuSE Local Security Checks	critical
124928	EulerOS Virtualization 3.0.1.0 : sqlite (EulerOS-SA-2019-1425)	Nessus	Huawei Local Security Checks	high
124856	SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2019:1208-1)	Nessus	SuSE Local Security Checks	critical
121829	Photon OS 1.0: Sqlite PHSA-2018-1.0-0126	Nessus	PhotonOS Local Security Checks	high
121133	Debian DLA-1633-1 : sqlite3 security update	Nessus	Debian Local Security Checks	critical
120739	Fedora 28 : sqlite (2018-bb66329dee)	Nessus	Fedora Local Security Checks	high
118429	EulerOS Virtualization 2.5.0 : sqlite (EulerOS-SA-2018-1341)	Nessus	Huawei Local Security Checks	high
111091	FreeBSD : SQLite -- Corrupt DB can cause a NULL pointer dereference (c1630aa3-7970-11e8-8634-dcfe074bd614)	Nessus	FreeBSD Local Security Checks	high
110844	EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2018-1180)	Nessus	Huawei Local Security Checks	high
110141	EulerOS 2.0 SP2 : sqlite (EulerOS-SA-2018-1137)	Nessus	Huawei Local Security Checks	high
110140	EulerOS 2.0 SP1 : sqlite (EulerOS-SA-2018-1136)	Nessus	Huawei Local Security Checks	high
108671	Fedora 26 : sqlite (2018-aace372c3f)	Nessus	Fedora Local Security Checks	high
108665	Fedora 27 : sqlite (2018-07e15ad5a5)	Nessus	Fedora Local Security Checks	high
108574	FreeBSD : SQLite -- Corrupt DB can cause a NULL pointer dereference (6d52bda1-2e54-11e8-a68f-485b3931c969)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-8740

high

Tenable Plugins

high

critical

medium

critical

high

high

critical

critical

high

critical

high

critical

high

high

high

high

high

high

high

high

high