{"id":"CVE-2015-3416","aliases":["DEBIAN-CVE-2015-3416","DSA-3252-1","DSA-3252-2","EUVD-2015-3460","GHSA-33jw-h57w-fr79","MGASA-2015-0234","RHSA-2015:1634","RHSA-2015:1635","UBUNTU-CVE-2015-3416","USN-2698-1","openSUSE-SU-2024:10290-1","openSUSE-SU-2024:10344-1"],"status":"published","title":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle...","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05418,"percentile":0.92757,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-190"],"published":"2015-04-24T00:00:00Z","modified":"2026-09-09T06:47:31Z","fixes":[{"ecosystem":"Debian:12","package":"sqlite3","fixed_in":["3.8.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.8.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.8.9-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"sqlite3","fixed_in":["3.7.13-1+deb7u2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-debuginfo","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"lemon","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-devel","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-doc","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-tcl","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-debuginfo","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"lemon","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-devel","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-doc","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-tcl","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-debuginfo","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-devel","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"lemon","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-doc","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-tcl","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-debuginfo","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-devel","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"lemon","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-doc","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-tcl","fixed_in":["0:3.6.20-1.el6_7.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"sqlite3","fixed_in":["3.8.2-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.7.1-1+deb8u1"}]}],"versions":["3.8.7.1-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.13-1+deb7u2"}]}],"versions":["3.7.13-1+deb7u1"]},{"source":"osv","ecosystem":"Mageia:4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10.1-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20150420.00-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.7.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.7.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.7.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.7.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-1.el6_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.ael7b_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.ael7b_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.ael7b_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.ael7b_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.ael7b_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.ael7b_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.17-6.el7_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu2.1"}]}],"versions":["3.7.17-1ubuntu1","3.8.0.2-1ubuntu1","3.8.1-1ubuntu1","3.8.1-1ubuntu3","3.8.2-1ubuntu1","3.8.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.17-8fakesync1","2.8.17-9fakesync1","2.8.17-10ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.17-12fakesync1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.17-14fakesync1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.17-15fakesync1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.17-15fakesync1build1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu2.1"}]}],"versions":["3.7.17-1ubuntu1","3.8.0.2-1ubuntu1","3.8.1-1ubuntu1","3.8.1-1ubuntu3","3.8.2-1ubuntu1","3.8.2-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.14-1.4"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.28-1.1"}]}],"bundled":71}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"watchos"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"php","product":"php"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2015-1634.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1635.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1033703","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/bid/74228","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://security.gentoo.org/glsa/201507-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2698-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.sqlite.org/src/info/c494171f77dc2e5e04cb6d865e688448f04e5920","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://support.apple.com/HT205267","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:217","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/HT205213","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3252","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2015/Apr/31","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","VDB Entry","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3416","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-33jw-h57w-fr79"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3416","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0234.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15920","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-46/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-48/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-51/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-54/","tags":["advisory"]},{"url":"https://sqlite.org/changes.html","tags":["web"]},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.18.1_release_notes","tags":["web"]},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/","tags":["web"]},{"url":"http://www.mandriva.com/en/support/security/advisories/mbs2/MDVSA-2015%3A217/","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2015/05/12/7","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2015-0988.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2015-1012.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15756","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1634","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212357","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1634.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3416","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1635","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212356","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1635.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3414","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3414","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3415","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3415","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3415","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3416","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2698-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-7443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3415","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-7243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4024","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3416","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","status":"published","published":"2015-04-24T17:00:00Z","modified":"2024-08-06T05:47:57.818Z","updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2015-3460","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","status":"published","published":"2015-04-24T17:00:00Z","modified":"2024-08-06T05:47:57Z","updated_at":"2026-11-03T02:22:08.106657Z"}],"ghsa":[{"id":"GHSA-33jw-h57w-fr79","title":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle...","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","status":"published","published":"2022-05-14T03:13:01Z","modified":"2023-01-28T05:01:13Z","cwes":["CWE-119","CWE-190"],"updated_at":"2026-11-02T14:43:31.331394Z"}],"nvd":[{"id":"CVE-2015-3416","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","status":"published","published":"2015-04-24T17:59:02.363Z","modified":"2026-06-17T00:25:53.843Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CVE-2015-3416","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","status":"published","published":"2015-04-24T17:59:02Z","modified":"2026-04-16T06:15:44.365140567Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3416","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","status":"published","published":"2015-04-24T17:59:02.363Z","modified":"2026-09-09T06:47:31.768534772Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3252-1","title":"sqlite3 - security update","status":"published","published":"2015-05-06T00:00:00Z","modified":"2026-03-09T01:21:05.780371Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3252-2","title":"sqlite3 - security update","status":"published","published":"2015-06-14T00:00:00Z","modified":"2026-03-09T01:22:07.80558Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0234","title":"Updated Firefox, Thunderbird \u0026 sqlite3 packages fix security vulnerabilities","description":"Updated firefox, thunderbird, and sqlite3 packages fix security\nvulnerabilities:\n\nSeveral flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Firefox or Thunderbird to\ncrash or, potentially, execute arbitrary code with the privileges of the\nuser running it (CVE-2015-2708, CVE-2015-2710, CVE-2015-2713).\n\nA heap-based buffer overflow flaw was found in the way Firefox and\nThunderbird processed compressed XML data. An attacker could create\nspecially crafted compressed XML content that, when processed by Firefox\nor Thunderbird, could cause it to crash or execute arbitrary code with the\nprivileges of the user running it (CVE-2015-2716).\n\nSQLite before 3.8.9 does not properly implement the dequoting of\ncollation-sequence names, which allows context-dependent attackers to\ncause a denial of service (uninitialized memory access and application\ncrash) or possibly have unspecified other impact via a crafted COLLATE\nclause, as demonstrated by COLLATE at the end of a SELECT statement\n(CVE-2015-3414).\n\nThe sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9\ndoes not properly implement comparison operators, which allows\ncontext-dependent attackers to cause a denial of service (invalid\nfree operation) or possibly have unspecified other impact via a\ncrafted CHECK clause, as demonstrated by CHECK(0\u0026O\u003eO) in a CREATE\nTABLE statement (CVE-2015-3415).\n\nThe sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does\nnot properly handle precision and width values during floating-point\nconversions, which allows context-dependent attackers to cause a\ndenial of service (integer overflow and stack-based buffer overflow)\nor possibly have unspecified other impact via large integers in a\ncrafted printf function call in a SELECT statement (CVE-2015-3416).\n\nThe sqlite3 package has been updated to version 3.10.8, fixing the\nCVE-2015-3414, CVE-2015-3415, and CVE-2015-3416 security issues, also\nfixing heap overflow and other possible issues found by fuzzing, as well\nas containing many other bug fixes and enhancements.\n\nThe nss package has been updated to version 3.19, containing multiple root\ncertificate updates, security enhancements, and other bug fixes.\n","status":"published","published":"2015-05-18T19:08:05Z","modified":"2026-04-16T06:23:06.033292946Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10290-1","title":"apache2-mod_php7-7.0.14-1.4 on GA media","description":"These are all security issues fixed in the apache2-mod_php7-7.0.14-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:03.261343Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10344-1","title":"apache2-mod_php5-5.6.28-1.1 on GA media","description":"These are all security issues fixed in the apache2-mod_php5-5.6.28-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:15.40421Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2015:1634","title":"Red Hat Security Advisory: sqlite security update","status":"published","published":"2024-09-15T22:45:44Z","modified":"2026-06-26T12:21:49.619909745Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1635","title":"Red Hat Security Advisory: sqlite security update","status":"published","published":"2024-09-15T22:45:50Z","modified":"2026-06-26T12:21:49.671515589Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"UBUNTU-CVE-2015-3416","description":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","status":"published","published":"2015-04-24T00:00:00Z","modified":"2026-04-22T10:08:19.981554Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2698-1","title":"sqlite3 vulnerabilities","description":"It was discovered that SQLite incorrectly handled skip-scan optimization.\nAn attacker could use this issue to cause applications using SQLite to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.04 LTS. (CVE-2013-7443)\n\nMichal Zalewski discovered that SQLite incorrectly handled dequoting of\ncollation-sequence names. An attacker could use this issue to cause\napplications using SQLite to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS\nand Ubuntu 15.04. (CVE-2015-3414)\n\nMichal Zalewski discovered that SQLite incorrectly implemented comparison\noperators. An attacker could use this issue to cause applications using\nSQLite to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 15.04. (CVE-2015-3415)\n\nMichal Zalewski discovered that SQLite incorrectly handle printf precision\nand width values during floating-point conversions. An attacker could use\nthis issue to cause applications using SQLite to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2015-3416)\n","status":"published","published":"2015-07-30T16:48:50Z","modified":"2026-04-27T15:17:30.918559787Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}