CVE-2015-3416: Buffer Overflow
The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3416?
CVE-2015-3416 has been classified with a moderate severity due to its potential for causing denial of service via integer overflow and stack-based buffer overflow.
How do I fix CVE-2015-3416?
To fix CVE-2015-3416, update SQLite to version 3.8.9 or later, or apply relevant patches from your operating system vendor.
What systems are affected by CVE-2015-3416?
CVE-2015-3416 affects various distributions including Ubuntu 12.04, 14.04, and 15.04, as well as Debian 8.0 and certain versions of macOS and PHP.
What types of vulnerabilities does CVE-2015-3416 introduce?
CVE-2015-3416 introduces vulnerabilities that can lead to denial of service through integer overflow and stack-based buffer overflow.
Is CVE-2015-3416 actively exploited in the wild?
As of the last updates, there have been no confirmed reports of active exploitation of CVE-2015-3416 in the wild, but it is advisable to apply patches promptly.