CVE-2017-10989: SQL Injection

Reference Links

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html
• http://marc.info/?l=sqlite-users&m=149933696214713&w=2
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.securityfocus.com/bid/99502
• http://www.securitytracker.com/id/1039427
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2405
• https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937
• https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html
• https://sqlite.org/src/info/66de6f4a
• https://sqlite.org/src/vpatch?from=0db20efe201736b3&to=66de6f4a9504ec26
• https://support.apple.com/HT208112
• https://support.apple.com/HT208113
• https://support.apple.com/HT208115
• https://support.apple.com/HT208144
• https://usn.ubuntu.com/4019-1/
• https://usn.ubuntu.com/4019-2/
• https://support.apple.com/en-us/HT208144 (Advisory)
• http://marc.info/?l=sqlite-users&m=149933696214713&w=2
• https://sqlite.org/src/vpatch?from=0db20efe201736b3&to=66de6f4a9504ec26
• https://launchpad.net/bugs/cve/CVE-2017-10989
• https://support.apple.com/en-us/HT208115 (Advisory)
• https://support.apple.com/en-us/HT208113 (Advisory)
• https://support.apple.com/en-us/HT208112 (Advisory)
• https://security-tracker.debian.org/tracker/CVE-2017-10989
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10989
• https://nvd.nist.gov/vuln/detail/CVE-2017-10989
• https://ubuntu.com/security/CVE-2017-10989
• https://my.f5.com/manage/s/article/K000141088

Parent vulnerabilities

(Appears in the following advisories)

• HT208144
• HT208115
• HT208113
• HT208112

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2017-13832
• CVE-2016-0736
• CVE-2016-2161
• CVE-2016-5387
• CVE-2016-8740
• CVE-2016-8743
• CVE-2017-13909
• CVE-2017-13809
• CVE-2017-7084
• CVE-2017-7074
• CVE-2017-13820
• CVE-2017-13807
• CVE-2017-7143
• CVE-2017-13829
• CVE-2017-13833
• CVE-2017-7083
• CVE-2017-13821
• CVE-2017-0381
• CVE-2017-13825
• CVE-2017-13890
• CVE-2017-13851
• CVE-2017-7138
• CVE-2017-7121
• CVE-2017-7122
• CVE-2017-7123
• CVE-2017-7124
• CVE-2017-7125
• CVE-2017-7126
• CVE-2017-13815
• CVE-2017-13828
• CVE-2017-13811
• CVE-2017-13835
• CVE-2017-11103
• CVE-2017-13819
• CVE-2017-13830
• CVE-2017-13814
• CVE-2017-13831
• CVE-2017-13837
• CVE-2017-13906
• CVE-2017-7077
• CVE-2017-7119
• CVE-2017-7114
• CVE-2017-13810
• CVE-2017-13817
• CVE-2017-13818
• CVE-2017-13836
• CVE-2017-13841
• CVE-2017-13840
• CVE-2017-13842
• CVE-2017-13782
• CVE-2017-13843
• CVE-2017-13854
• CVE-2017-13834
• CVE-2017-13873
• CVE-2017-13827
• CVE-2017-13813
• CVE-2017-13816
• CVE-2017-13812
• CVE-2016-4736
• CVE-2017-7086
• CVE-2017-1000373
• CVE-2016-9063
• CVE-2017-9233
• CVE-2018-4302
• CVE-2017-5130
• CVE-2017-7376
• CVE-2017-9050
• CVE-2017-9049
• CVE-2017-7141
• CVE-2017-7078
• CVE-2017-6451
• CVE-2017-6452
• CVE-2017-6455
• CVE-2017-6458
• CVE-2017-6459
• CVE-2017-6460
• CVE-2017-6462
• CVE-2017-6463
• CVE-2017-6464
• CVE-2016-9042
• CVE-2017-13824
• CVE-2017-13846
• CVE-2017-10140
• CVE-2017-13822
• CVE-2017-7132
• CVE-2017-13823
• CVE-2017-13808
• CVE-2017-13838
• CVE-2017-7082
• CVE-2017-7080
• CVE-2017-13908
• CVE-2017-13839
• CVE-2017-13910
• CVE-2017-10989
• CVE-2017-7128
• CVE-2017-7129
• CVE-2017-7130
• CVE-2017-7127
• CVE-2016-9840
• CVE-2016-9841
• CVE-2016-9842
• CVE-2016-9843
• CVE-2017-7103
• CVE-2017-7105
• CVE-2017-7108
• CVE-2017-7110
• CVE-2017-7112
• CVE-2017-7116
• CVE-2017-7081
• CVE-2017-7087
• CVE-2017-7091
• CVE-2017-7092
• CVE-2017-7093
• CVE-2017-7094
• CVE-2017-7095
• CVE-2017-7096
• CVE-2017-7098
• CVE-2017-7099
• CVE-2017-7100
• CVE-2017-7102
• CVE-2017-7104
• CVE-2017-7107
• CVE-2017-7111
• CVE-2017-7117
• CVE-2017-7120
• CVE-2017-7090
• CVE-2017-7109
• CVE-2017-11120
• CVE-2017-11121
• CVE-2017-7115
• CVE-2017-11122
• CVE-2017-13863
• CVE-2017-7131
• CVE-2017-7088
• CVE-2017-7072
• CVE-2017-7140
• CVE-2017-7148
• CVE-2017-7097
• CVE-2017-7118
• CVE-2017-7133
• CVE-2017-7075
• CVE-2017-7139
• CVE-2017-13806
• CVE-2017-7085
• CVE-2017-13877
• CVE-2017-7146
• CVE-2017-6211
• CVE-2017-7145
• CVE-2017-7089
• CVE-2017-7106
• CVE-2017-7144
• CVE-2017-7142

Frequently Asked Questions

• What is CVE-2017-10989?

  CVE-2017-10989 is a vulnerability in SQLite through version 3.19.3 that mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or other unspecified impact.

• What is the severity of CVE-2017-10989?

  CVE-2017-10989 has a severity score of 9.8 (Critical).

• Which software products are affected by CVE-2017-10989?

  Software products such as GDAL, Debian SQLite, Debian SQLite3, Ubuntu SQLite3, Apple macOS High Sierra, Apple tvOS, Apple iOS, and Apple watchOS are affected by CVE-2017-10989.

• How can I fix the vulnerability CVE-2017-10989?

  To fix CVE-2017-10989, update SQLite to version 3.19.3 or higher.

• Where can I find more information about CVE-2017-10989?

  You can find more information about CVE-2017-10989 on the following references: [1] http://marc.info/?l=sqlite-users&m=149933696214713&w=2, [2] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2405, [3] https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937