CVE-2017-13685: SQL Injection
Published Aug 29, 2017
·Updated
Last updated 25 August 2025
Other sources
The dumpcallback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXCBADACCESS and application crash) via a crafted file.
— Launchpad
Affected Software
2 affected componentsFixes available
SQLite SQLite=3.20.0
debian/sqlite3
3.34.1-33.34.1-3+deb11u13.40.1-2+deb12u23.46.1-73.46.1-9
Remediation
Patch Available
Event History
Aug 29, 2017
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Data Sourced
via NVD·06:29 AM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:29 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·06:01 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·06:02 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2017-13685.
2
What is the severity level of CVE-2017-13685?
The severity level of CVE-2017-13685 is medium.
3
How does CVE-2017-13685 impact the affected software?
CVE-2017-13685 can cause a denial of service (EXC_BAD_ACCESS and application crash) in the affected software.
4
Which versions of the affected software are vulnerable to CVE-2017-13685?
Versions up to and including 3.20.0 of SQLite and versions up to and including 3.8.2-1ubuntu2.2+ of sqlite3 are vulnerable to CVE-2017-13685.
5
How can I fix CVE-2017-13685?
Upgrade to version 3.27.2-3+deb10u1 or later for SQLite, and upgrade to version 3.8.2-1ubuntu2.2+ or later for sqlite3.