CVE-2015-3414: SQL Injection
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3414?
CVE-2015-3414 has a severity rating that indicates a risk of denial of service due to uninitialized memory access.
How do I fix CVE-2015-3414?
To fix CVE-2015-3414, upgrade to SQLite version 3.8.9 or later.
Which versions of SQLite are affected by CVE-2015-3414?
Versions of SQLite before 3.8.9, specifically up to 3.8.8.3, are vulnerable to CVE-2015-3414.
Can CVE-2015-3414 be exploited remotely?
CVE-2015-3414 may be exploited by context-dependent attackers through crafted COLLATE clauses.
What types of systems are vulnerable to CVE-2015-3414?
Systems running affected versions of SQLite, including certain versions of macOS, Debian, and various Ubuntu releases, are vulnerable to CVE-2015-3414.