CVE-2019-9936: SQL Injection
Published Mar 22, 2019
·Updated
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5hash.c.
Affected Software
3 affected componentsFixes available
SQLite SQLite=3.27.2
Google Android
debian/sqlite3
3.34.1-33.34.1-3+deb11u13.40.1-2+deb12u23.46.1-73.46.1-9
Remediation
Patch Available
Event History
Mar 22, 2019
CVE Published
via MITRE·07:07 AM
Data Sourced
via MITRE·07:07 AM
Description
Apr 6, 2020
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Feb 19, 2026
Data Sourced
via Ubuntu·06:01 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·06:02 PM
Description
Data Sourced
via Debian·06:02 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-9936?
The severity of CVE-2019-9936 is high with a CVSS score of 7.5.
2
How can running fts5 prefix queries inside a transaction trigger a vulnerability in SQLite 3.27.2?
Running fts5 prefix queries inside a transaction can trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, leading to an information leak.
3
Which software versions are affected by CVE-2019-9936?
SQLite 3.27.2 is affected by CVE-2019-9936.
4
Is Google Android affected by CVE-2019-9936?
Yes, Google Android is affected by CVE-2019-9936.
5
How can I fix the vulnerability in SQLite 3.27.2?
To fix the vulnerability in SQLite 3.27.2, you should update to a version that is not affected by the vulnerability.