CVE-2015-3415: SQL Injection
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3415?
CVE-2015-3415 has a medium severity rating due to potential denial of service vulnerabilities.
How do I fix CVE-2015-3415?
To fix CVE-2015-3415, upgrade SQLite to version 3.8.9 or later.
Which software is affected by CVE-2015-3415?
CVE-2015-3415 affects SQLite versions before 3.8.9 and various operating systems including macOS, Debian, and Ubuntu.
What kind of attack can exploit CVE-2015-3415?
CVE-2015-3415 can be exploited by context-dependent attackers through a crafted CHECK clause, leading to invalid free operations.
Is there any workaround for CVE-2015-3415?
There are no known workarounds for CVE-2015-3415 other than upgrading the affected software to a secure version.