CVE-2019-19880 Null dereference in n/a
Attackers can cause a denial of service in SQLite by triggering an invalid pointer dereference via crafted ORDER BY clauses in window definitions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19880?
CVE-2019-19880 is a high-severity vulnerability in Debian Debian Linux, published on 18 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Weakness: CWE-476
Which versions are affected by CVE-2019-19880?
It affects 11 products.
Products include Debian Debian Linux, Netapp Cloud Backup, Opensuse Backports Sle, Opensuse Leap, Oracle Mysql Workbench, Redhat Enterprise Linux Desktop and 5 more.
How do I fix CVE-2019-19880?
Upgrade to a fixed version.
Is CVE-2019-19880 being exploited?
There is no known exploitation of CVE-2019-19880 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-19880, GHSA-mpvh-7x64-2fc7.