CVE-2016-6153: SQL Injection
Published Sep 26, 2016
·Updated
Last updated 25 August 2025
Other sources
osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
— Launchpad
Affected Software
4 affected componentsFixes available
SQLite SQLite<=3.12.2
Fedoraproject Fedora=24
openSUSE Leap=42.1
debian/sqlite3
3.34.1-33.34.1-3+deb11u13.40.1-2+deb12u23.46.1-73.46.1-9
Remediation
Patch Available
Event History
Sep 26, 2016
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·06:01 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·06:02 PM
Description
Data Sourced
via Debian·06:02 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-6153.
2
What is the severity rating of CVE-2016-6153?
CVE-2016-6153 has a severity rating of 5.9 (Medium).
3
What does the vulnerability CVE-2016-6153 affect?
CVE-2016-6153 affects SQLite versions before 3.13.0.
4
How can an attacker exploit CVE-2016-6153?
An attacker can exploit CVE-2016-6153 by leveraging the use of the current working directory for temporary files.
5
Is there a fix available for CVE-2016-6153?
Yes, there is a fix available for CVE-2016-6153. Users should update to SQLite version 3.13.0 or later.