CVE-2017-2519
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10...
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
- Record
CVE-2017-2519- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
- Record
CVE-2017-2519- Updated
- 2026-11-02
EUVDEUVD-2017-11702 No score
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
- Record
EUVD-2017-11702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q5c7-pq55-4q3p
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10...
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
- Record
GHSA-q5c7-pq55-4q3p- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
- Record
CVE-2017-2519- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-2519
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
- Record
DEBIAN-CVE-2017-2519- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-2519
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
- Record
UBUNTU-CVE-2017-2519- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-4019-1 No score
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2518, CVE-2017-2520)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20505)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20346, CVE-2018-20506)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. (CVE-2019-8457)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9936)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9937)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)
It was discovered that SQLite incorrectly handled certain databases. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)
It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2519)
- Record
USN-4019-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqlite3Debian:12 |
before 3.16.0-1 | 3.16.0-1 |
sqlite3Debian:13 |
before 3.16.0-1 | 3.16.0-1 |
sqlite3Debian:14 |
before 3.16.0-1 | 3.16.0-1 |
sqlite3Debian:8 From an advisory covering 5 CVEs |
before 3.8.7.1-1+deb8u4, plus listed versions 3.8.7.1-13.8.7.1-1+deb8u13.8.7.1-1+deb8u23.8.7.1-1+deb8u3 |
3.8.7.1-1+deb8u4 |
sqlite3Ubuntu:16.04:LTS |
before 3.11.0-1ubuntu1.2, plus listed versions 3.8.11.1-13.9.1-23.9.2-13.10.0-13.10.1-13.10.2-13.11.0-1ubuntu13.11.0-1ubuntu1.1 |
3.11.0-1ubuntu1.2 |
sqlite3Ubuntu:16.04:LTS From an advisory covering 12 CVEs |
before 3.11.0-1ubuntu1.2, plus listed versions 3.8.11.1-13.9.1-23.9.2-13.10.0-13.10.1-13.10.2-13.11.0-1ubuntu13.11.0-1ubuntu1.1 |
3.11.0-1ubuntu1.2 |
sqlite3Ubuntu:18.04:LTS From an advisory covering 12 CVEs |
before 3.22.0-1ubuntu0.1, plus listed versions 3.19.3-33.20.1-23.21.0-13.22.0-1 |
3.22.0-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2519 is a critical vulnerability (CVSS 9.8) in Apple Tvos, published May 22, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.95%, the 90th percentile. Fixed in sqlite3 3.16.0-1.
References
securitytracker.com/id/1038484
support.apple.com/HT207797
lists.debian.org/debian-lts-announce/2019/01/msg00009.html
securityfocus.com/bid/98468
Show 20 moreShow less
usn.ubuntu.com/4019-1
nvd.nist.gov/vuln/detail/CVE-2017-2519
github.com/advisories/GHSA-q5c7-pq55-4q3p
security-tracker.debian.org/tracker/CVE-2017-2519
ubuntu.com/security/CVE-2017-2519
clusterfuzz-external.appspot.com/testcase?key=6739028850245632
cve.org/CVERecord?id=CVE-2017-2519