CVE-2019-9936: SQL Injection
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5hash.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u2Fixed in 3.53.4-2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9936?
The severity of CVE-2019-9936 is high with a CVSS score of 7.5.
How can running fts5 prefix queries inside a transaction trigger a vulnerability in SQLite 3.27.2?
Running fts5 prefix queries inside a transaction can trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, leading to an information leak.
Which software versions are affected by CVE-2019-9936?
SQLite 3.27.2 is affected by CVE-2019-9936.
Is Google Android affected by CVE-2019-9936?
Yes, Google Android is affected by CVE-2019-9936.
How can I fix the vulnerability in SQLite 3.27.2?
To fix the vulnerability in SQLite 3.27.2, you should update to a version that is not affected by the vulnerability.