CVE-2016-6153: SQL Injection
Last updated 25 August 2025
Other sources
osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u2Fixed in 3.53.4-2 - Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-6153.
What is the severity rating of CVE-2016-6153?
CVE-2016-6153 has a severity rating of 5.9 (Medium).
What does the vulnerability CVE-2016-6153 affect?
CVE-2016-6153 affects SQLite versions before 3.13.0.
How can an attacker exploit CVE-2016-6153?
An attacker can exploit CVE-2016-6153 by leveraging the use of the current working directory for temporary files.
Is there a fix available for CVE-2016-6153?
Yes, there is a fix available for CVE-2016-6153. Users should update to SQLite version 3.13.0 or later.