CVE-2019-8457 Memory corruption in SQLite
An out-of-bounds read in SQLite's rtree handling allows attackers to cause denial of service or disclose memory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-8457?
CVE-2019-8457 is a critical memory corruption vulnerability in Canonical Ubuntu Linux, published on 30 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
Weakness: CWE-125
Which versions are affected by CVE-2019-8457?
It affects 4 products.
Linux distribution packages (17)
sqlite3 SUSE:Enterprise Storage 4 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 3.7.6.3-1.4.7.9.1 |
sqlite3 SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 3.7.6.3-1.4.7.9.1 |
sqlite3 SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server 12 SP3 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server 12 SP4 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 3.8.10.2-9.9.1 |
sqlite3 SUSE:OpenStack Cloud 7 | All versions | 3.8.10.2-9.9.1 |
Products include Canonical Ubuntu Linux, Fedoraproject Fedora, Opensuse Leap, Sqlite Sqlite.
How do I fix CVE-2019-8457?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-8457 being exploited?
There is no known exploitation of CVE-2019-8457 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2019-8457, AZL-38326, CLEANSTART-2026-SX98768, DEBIAN-CVE-2019-8457, GHSA-p4jx-5p2x-4pq7, ROOT-OS-DEBIAN-11-CVE-2019-8457 and 5 more.