SQLite Information Disclosure and Denial of Service Vulnerabilities

Bugtraq ID:	107562
Class:	Unknown
CVE:	CVE-2019-9936 CVE-2019-9937
Remote:	Yes
Local:	No
Published:	Mar 18 2019 12:00AM
Updated:	Mar 18 2019 12:00AM
Credit:	Chu
Vulnerable:	SQLite SQLite 3.27.2
Not Vulnerable:

SQLite Information Disclosure and Denial of Service Vulnerabilities

SQLite is prone to an information-disclosure vulnerability and a denial-of-service vulnerability.

Successfully exploiting these issues may allow an attacker to obtain sensitive information or to consume excessive resources, resulting in a denial of service.

SQLite 3.27.2 is vulnerable; other versions may also be affected.

SQLite Information Disclosure and Denial of Service Vulnerabilities

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

SQLite Information Disclosure and Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SQLite Information Disclosure and Denial of Service Vulnerabilities

References:

• [sqlite] FTS5 Transaction Leads to OOB Read (SQLite)
  
• Fix a buffer overread that could occur when running fts5 prefix queries (SQLite)
  
• Fix an fts5 problem with interleaving reads and writes in a single transaction. (SQLite)
  
• Re: [sqlite] FTS5 Transaction Leads to NULL Pointer (SQLite)
  
• SQLite Homepage (SQLite)
  
• [sqlite] FTS5 Transaction Leads to NULL Pointer (SQLite)
  
• Bug 1692357 (CVE-2019-9937) sqlite: null-pointer dereference (Redhat)
  
• Bug 1692365 CVE-2019-9936 sqlite: heap-based buffer over-read (Redhat)
  
• CVE-2019-9936 (Redhat)
  
• CVE-2019-9937 (Redhat)
  
• Re: [sqlite] FTS5 Transaction Leads to OOB Read (SQLite)