CVE-2017-13685: SQL Injection
Last updated 25 August 2025
Other sources
The dumpcallback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXCBADACCESS and application crash) via a crafted file.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u2Fixed in 3.53.4-2
Event History
Frequently Asked Questions
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2017-13685.
What is the severity level of CVE-2017-13685?
The severity level of CVE-2017-13685 is medium.
How does CVE-2017-13685 impact the affected software?
CVE-2017-13685 can cause a denial of service (EXC_BAD_ACCESS and application crash) in the affected software.
Which versions of the affected software are vulnerable to CVE-2017-13685?
Versions up to and including 3.20.0 of SQLite and versions up to and including 3.8.2-1ubuntu2.2+ of sqlite3 are vulnerable to CVE-2017-13685.
How can I fix CVE-2017-13685?
Upgrade to version 3.27.2-3+deb10u1 or later for SQLite, and upgrade to version 3.8.2-1ubuntu2.2+ or later for sqlite3.