CVE-2015-3416 Integer overflow in n/a

High 7.5 Published 24 Apr 2015 Updated 6 Aug 2024

Attackers can cause denial of service or potential code execution via crafted SQL queries exploiting integer overflow in SQLite's printf function.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-3416?

CVE-2015-3416 is a high-severity vulnerability in Apple Mac Os X, published on 24 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

Weakness: CWE-190

Which versions are affected by CVE-2015-3416?

It affects 6 products.

Linux distribution packages (24)

`lemon` Red Hat:enterprise_linux:6::client	All versions	`0:3.6.20-1.el6_7.2`
`sqlite` Red Hat:enterprise_linux:6::client	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-devel` Red Hat:enterprise_linux:6::client	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-doc` Red Hat:enterprise_linux:6::client	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-tcl` Red Hat:enterprise_linux:6::client	All versions	`0:3.6.20-1.el6_7.2`
`lemon` Red Hat:enterprise_linux:6::computenode	All versions	`0:3.6.20-1.el6_7.2`
`sqlite` Red Hat:enterprise_linux:6::computenode	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-doc` Red Hat:enterprise_linux:6::computenode	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-tcl` Red Hat:enterprise_linux:6::computenode	All versions	`0:3.6.20-1.el6_7.2`
`lemon` Red Hat:enterprise_linux:6::server	All versions	`0:3.6.20-1.el6_7.2`
`sqlite` Red Hat:enterprise_linux:6::server	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-devel` Red Hat:enterprise_linux:6::server	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-doc` Red Hat:enterprise_linux:6::server	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-tcl` Red Hat:enterprise_linux:6::server	All versions	`0:3.6.20-1.el6_7.2`
`lemon` Red Hat:enterprise_linux:6::workstation	All versions	`0:3.6.20-1.el6_7.2`
`sqlite` Red Hat:enterprise_linux:6::workstation	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-doc` Red Hat:enterprise_linux:6::workstation	All versions	`0:3.6.20-1.el6_7.2`
`sqlite-tcl` Red Hat:enterprise_linux:6::workstation	All versions	`0:3.6.20-1.el6_7.2`

Products include Apple Mac Os X, Apple Watchos, Canonical Ubuntu Linux, Debian Debian Linux, Php Php, Sqlite Sqlite.

How do I fix CVE-2015-3416?

Upgrade to a fixed version.

Is CVE-2015-3416 being exploited?

There is no known exploitation of CVE-2015-3416 in the wild and no public exploit code.

All Apple Mac Os X vulnerabilities

Sources

Also known as DEBIAN-CVE-2015-3416, DSA-3252-2, GHSA-33jw-h57w-fr79, RHSA-2015:1634, UBUNTU-CVE-2015-3416.