{"id":"CVE-2019-16168","aliases":["ALPINE-CVE-2019-16168","ALSA-2021:1968","AZL-38191","BELL-CVE-2019-16168","DEBIAN-CVE-2019-16168","DLA-2340-1","EUVD-2019-6988","GHSA-m2vp-56p6-9q2h","MGASA-2020-0070","RHSA-2020:4442","RHSA-2021:1968","RLSA-2021:1968","SUSE-SU-2019:2533-1","SUSE-SU-2019:2536-1","SUSE-SU-2021:3215-1","UBUNTU-CVE-2019-16168","USN-4205-1","openSUSE-SU-2019:2298-1","openSUSE-SU-2019:2300-1","openSUSE-SU-2024:11400-1"],"status":"published","title":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other...","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04219,"percentile":0.91061,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2019-09-09T16:07:15Z","modified":"2026-10-29T11:01:21Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"sqlite","fixed_in":["3.28.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sqlite","fixed_in":["3.25.3-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sqlite","fixed_in":["3.28.0-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ceph","fixed_in":["18.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sqlite3","fixed_in":["3.29.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.29.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.29.0-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"sqlite3","fixed_in":["3.28.0-3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"sqlite3","fixed_in":["3.28.0-3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"sqlite3","fixed_in":["3.8.10.2-9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"sqlite3","fixed_in":["3.8.10.2-9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"sqlite3","fixed_in":["3.8.10.2-9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sqlite3","fixed_in":["3.8.10.2-9.12.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"sqlite3","fixed_in":["3.11.0-1ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","fixed_in":["3.22.0-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"sqlite3","fixed_in":["3.28.0-lp150.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"sqlite3","fixed_in":["3.28.0-lp151.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.28.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.25.3-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.28.0-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw-binutils-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw-filesystem-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"104-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-bzip2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"104-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-sqlite-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-bzip2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"104-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-sqlite-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.0-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.2-5+deb9u2"}]}],"versions":["3.16.2-5","3.16.2-5+deb9u1"],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.1-1.mga7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-binutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-binutils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-binutils-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-binutils-generic-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:104-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-filesystem-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:104-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-binutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-bzip2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-bzip2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:104-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-sqlite-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-binutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-bzip2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-bzip2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:104-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-sqlite-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mingw-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.30-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mingw-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mingw-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0.0-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10.2-9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10.2-9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10.2-9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10.2-9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-9.18.1"}]}],"bundled":28},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.3"}]}],"versions":["3.8.11.1-1","3.9.1-2","3.9.2-1","3.10.0-1","3.10.1-1","3.10.2-1","3.11.0-1ubuntu1","3.11.0-1ubuntu1.1","3.11.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-1ubuntu0.2"}]}],"versions":["3.19.3-3","3.20.1-2","3.21.0-1","3.22.0-1","3.22.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.3"}]}],"versions":["3.8.11.1-1","3.9.1-2","3.9.2-1","3.10.0-1","3.10.1-1","3.10.2-1","3.11.0-1ubuntu1","3.11.0-1ubuntu1.1","3.11.0-1ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-1ubuntu0.2"}]}],"versions":["3.19.3-3","3.20.1-2","3.21.0-1","3.22.0-1","3.22.0-1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-lp150.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-lp151.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1.2"}]}],"bundled":10}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mcafee","product":"policy_auditor"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"netapp","product":"santricity_unified_manager"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"oracle","product":"communications_design_studio"},{"vendor":"oracle","product":"jdk"},{"vendor":"oracle","product":"jre"},{"vendor":"oracle","product":"mysql"},{"vendor":"oracle","product":"outside_in_technology"},{"vendor":"oracle","product":"solaris"},{"vendor":"oracle","product":"zfs_storage_appliance"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"sqlite","product":"sqlite"},{"vendor":"tenable","product":"nessus_agent"}],"references":[{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.sqlite.org/src/timeline?c=98357d8c1263920b","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190926-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://usn.ubuntu.com/4205-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200122-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2021-08","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2021-11","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2021-14","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16168","tags":["web","advisory"]},{"url":"https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg116312.html","tags":["report"]},{"url":"https://usn.ubuntu.com/4205-1"},{"url":"https://security.netapp.com/advisory/ntap-20200122-0003"},{"url":"https://security.netapp.com/advisory/ntap-20190926-0003"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2"},{"url":"https://github.com/advisories/GHSA-m2vp-56p6-9q2h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-16168","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1968","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1768986","tags":["report"]},{"url":"https://bugzilla.redhat.com/1841223","tags":["report"]},{"url":"https://bugzilla.redhat.com/1841562","tags":["report"]},{"url":"https://bugzilla.redhat.com/1841568","tags":["report"]},{"url":"https://bugzilla.redhat.com/1841574","tags":["report"]},{"url":"https://bugzilla.redhat.com/1918306","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-1968.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-16168","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-13434","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-13630","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-13631","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-13632","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-16168","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-16168","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0070.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26104","tags":["report"]},{"url":"https://www.sqlite.org/releaselog/3_29_0.html","tags":["web"]},{"url":"https://www.sqlite.org/releaselog/3_30_0.html","tags":["web"]},{"url":"https://www.sqlite.org/releaselog/3_30_1.html","tags":["web"]},{"url":"https://www.sqlite.org/releaselog/3_31_0.html","tags":["web"]},{"url":"https://www.sqlite.org/releaselog/3_31_1.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4442","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1809315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1841562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1841568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1841574","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4442.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-5018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-5018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5018","tags":["advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0777","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16168","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16168","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20218","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-6405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6405","tags":["advisory"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9327","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13630","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13630","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13631","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13632","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1841223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918306","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1968.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13434","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1968","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192533-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1150137","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16168","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192536-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213215-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157818","tags":["report"]},{"url":"https://bugzilla.suse.com/1158812","tags":["report"]},{"url":"https://bugzilla.suse.com/1158958","tags":["report"]},{"url":"https://bugzilla.suse.com/1158959","tags":["report"]},{"url":"https://bugzilla.suse.com/1158960","tags":["report"]},{"url":"https://bugzilla.suse.com/1159491","tags":["report"]},{"url":"https://bugzilla.suse.com/1159715","tags":["report"]},{"url":"https://bugzilla.suse.com/1159847","tags":["report"]},{"url":"https://bugzilla.suse.com/1159850","tags":["report"]},{"url":"https://bugzilla.suse.com/1160309","tags":["report"]},{"url":"https://bugzilla.suse.com/1160438","tags":["report"]},{"url":"https://bugzilla.suse.com/1160439","tags":["report"]},{"url":"https://bugzilla.suse.com/1164719","tags":["report"]},{"url":"https://bugzilla.suse.com/1172091","tags":["report"]},{"url":"https://bugzilla.suse.com/1172115","tags":["report"]},{"url":"https://bugzilla.suse.com/1172234","tags":["report"]},{"url":"https://bugzilla.suse.com/1172236","tags":["report"]},{"url":"https://bugzilla.suse.com/1172240","tags":["report"]},{"url":"https://bugzilla.suse.com/1173641","tags":["report"]},{"url":"https://bugzilla.suse.com/928700","tags":["report"]},{"url":"https://bugzilla.suse.com/928701","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9327","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-16168","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4205-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-8740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19244","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5Q5DFFGTODE2HQHIRGFUXPQORMI6ENAB/#5Q5DFFGTODE2HQHIRGFUXPQORMI6ENAB","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BOJI6OIA57HPKASWCXNQ6VZE3OG6FN6B/#BOJI6OIA57HPKASWCXNQ6VZE3OG6FN6B","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13871","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T16:07:15Z","modified":"2026-10-14T06:50:13.466Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2019-6988","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T16:07:15Z","modified":"2026-10-14T06:50:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-m2vp-56p6-9q2h","title":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other...","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2022-05-24T16:55:44Z","modified":"2026-10-14T09:32:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T17:15:13.91Z","modified":"2026-10-14T07:16:48.253Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"ALPINE-CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T17:15:13.91Z","modified":"2026-09-21T06:17:52.494715576Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"AZL-38191","title":"CVE-2019-16168 affecting package ceph for versions less than 18.2.1-1","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T17:15:13Z","modified":"2026-04-21T04:49:47.172146Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2019-16168","title":"CVE-2019-16168 does not affect BellSoft software","status":"withdrawn","published":"2019-09-09T17:15:00Z","modified":"2026-01-26T09:48:28.049282Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T17:15:13.91Z","modified":"2026-10-24T10:30:22.254135525Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T17:15:13.91Z","modified":"2026-10-15T07:47:26.749430876Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:4442","title":"Red Hat Security Advisory: sqlite security update","status":"published","published":"2024-09-16T03:53:13Z","modified":"2026-10-15T10:01:40Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:1968","title":"Red Hat Security Advisory: mingw packages security and bug fix update","status":"published","published":"2024-09-13T22:13:20Z","modified":"2026-10-15T10:01:50Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1968","title":"Moderate: mingw packages security and bug fix update","description":"MinGW is a free and open source software development environment to create Microsoft Windows applications.\n\nThe following packages have been upgraded to a later upstream version: mingw-sqlite (3.26.0.0). (BZ#1845475)\n\nSecurity Fix(es):\n\n* sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)\n\n* sqlite: Integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)\n\n* sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)\n\n* sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)\n\n* sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query (CVE-2020-13632)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2026-01-07T09:02:16.167403Z","modified":"2026-01-07T09:29:58.559834Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"","status":"published","published":"2019-09-09T17:15:00Z","modified":"2026-05-29T18:00:12.748366785Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALSA-2021:1968","title":"Moderate: mingw packages security and bug fix update","description":"MinGW is a free and open source software development environment to create Microsoft Windows applications.\n\nThe following packages have been upgraded to a later upstream version: mingw-sqlite (3.26.0.0). (BZ#1845475)\n\nSecurity Fix(es):\n\n* sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)\n\n* sqlite: Integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)\n\n* sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)\n\n* sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)\n\n* sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query (CVE-2020-13632)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:30:39Z","modified":"2026-10-29T11:01:21.603408862Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2340-1","title":"sqlite3 - security update","status":"published","published":"2020-08-22T00:00:00Z","modified":"2026-03-09T01:23:17.285848Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2020-0070","title":"Updated sqlite3 packages fix security vulnerabilities","description":"Updated sqlite3 packages fix security vulnerabilities:\n\nAn out of bounds write flaw (CVE-2019-13734), insufficient data validation\nflaw (CVE-2019-13750), uninitialized use flaw (CVE-2019-13751), and out of\nbounds read flaws (CVE-2019-13752, CVE-2019-13753) in SQLite before 3.31.0.\n\nIt was discovered that SQLite incorrectly handled certain schemas. An\nattacker could possibly use this issue to cause a denial of service\n(CVE-2019-16168).\n\nIt was discovered that SQLite incorrectly handled certain schemas. An\nattacker could possibly use this issue to mishandles some expressions\n(CVE-2019-19242).\n\nIt was discovered that SQLite incorrectly handled certain queries. An\nattacker could possibly use this issue to execute arbitrary code\n(CVE-2019-19244).\n\nexprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger\nan invalid pointer dereference because constant integer values in ORDER BY\nclauses of window definitions are mishandled (CVE-2019-19880).\n\nFor other changes in this update, see the referenced releaaselogs.\n","status":"published","published":"2020-01-30T18:28:34Z","modified":"2026-04-16T04:44:19.743145533Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2298-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16168: Fixed improper validation of sqlite_stat1 field that could lead to denial of service (bsc#1150137).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-08T16:24:16Z","modified":"2026-02-04T03:06:41.50457Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2300-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16168: Fixed improper validation of sqlite_stat1 field that could lead to denial of service (bsc#1150137).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-08T16:24:35Z","modified":"2026-02-04T03:12:12.423488Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11400-1","title":"libsqlite3-0-3.36.0-1.2 on GA media","description":"These are all security issues fixed in the libsqlite3-0-3.36.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:18.788761Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:2533-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16168: Fixed improper validation of sqlite_stat1 field that could lead to denial of service (bsc#1150137).\n","status":"published","published":"2019-10-03T13:02:53Z","modified":"2026-02-04T02:26:34.519905Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:2536-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16168: Fixed improper validation of sqlite_stat1 field that could lead to denial of service (bsc#1150137).\n","status":"published","published":"2019-10-03T13:03:20Z","modified":"2026-02-04T03:41:13.371755Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2021:3215-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nsqlite3 is sync version 3.36.0 from Factory (jsc#SLE-16032).\n\nThe following CVEs have been fixed in upstream releases up to\nthis point, but were not mentioned in the change log so far:\n\n* bsc#1173641, CVE-2020-15358: heap-based buffer overflow in\n  multiSelectOrderBy due to mishandling of query-flattener\n  optimization\n* bsc#1164719, CVE-2020-9327: NULL pointer dereference and\n  segmentation fault because of generated column optimizations in\n  isAuxiliaryVtabOperator\n* bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds\n  with WITH stack unwinding even after a parsing error\n* bsc#1160438, CVE-2019-19959: memory-management error via\n  ext/misc/zipfile.c involving embedded '\\0' input\n* bsc#1160309, CVE-2019-19923: improper handling  of  certain uses\n  of SELECT DISTINCT in flattenSubquery may lead to null pointer\n  dereference\n* bsc#1159850, CVE-2019-19924: improper error handling in\n  sqlite3WindowRewrite()\n* bsc#1159847, CVE-2019-19925: improper handling of NULL pathname\n  during an update of a ZIP archive\n* bsc#1159715, CVE-2019-19926: improper handling  of certain\n  errors during parsing  multiSelect in select.c\n* bsc#1159491, CVE-2019-19880: exprListAppendList in window.c\n  allows attackers to trigger an invalid pointer dereference\n* bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE\n  and CREATE VIEW statements, does not consider confusion with\n  a shadow table name\n* bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an\n  integrity_check PRAGMA command in certain cases of generated\n  columns\n* bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger\n  infinite recursion via certain types of self-referential views\n  in conjunction with ALTER TABLE statements\n* bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits\n  from the colUsed bitmask in the case of a generated column,\n  which allows attackers to cause a denial of service\n* bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The\n  function sqlite3Select in select.c allows a crash if a\n  sub-select uses both DISTINCT and window functions, and also\n  has certain ORDER BY usage\n* bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator\n  vulnerability\n* bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of\n  collation-sequence names\n* CVE-2020-13434 bsc#1172115: integer overflow in\n  sqlite3_str_vappendf\n* CVE-2020-13630 bsc#1172234: use-after-free in fts3EvalNextRow\n* CVE-2020-13631 bsc#1172236: virtual table allowed to be renamed\n  to one of its shadow tables\n* CVE-2020-13632 bsc#1172240: NULL pointer dereference via\n  crafted matchinfo() query\n* CVE-2020-13435: Malicious SQL statements could have crashed the\n  process that is running SQLite (bsc#1172091)\n","status":"published","published":"2021-09-23T14:26:45Z","modified":"2026-02-04T02:57:08.059032Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-4205-1","title":"sqlite3 vulnerabilities","description":"It was discovered that SQLite incorrectly handled certain schemas.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 12.04 ESM. (CVE-2018-8740)\n\nIt was discovered that SQLite incorrectly handled certain schemas.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 19.04.\n(CVE-2019-16168)\n\nIt was discovered that SQLite incorrectly handled certain schemas.\nAn attacker could possibly use this issue to mishandles some expressions.\nThis issue only affected Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-19242)\n\nIt was discovered that SQLite incorrectly handled certain queries.\nAn attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-19244)\n\nIt was discovered that SQLite incorrectly handled certain SQL commands.\nAn attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 19.04. (CVE-2019-5018)\n\nIt was discovered that SQLite incorrectly handled certain commands. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2019-5827)\n","status":"published","published":"2019-12-02T12:30:54Z","modified":"2026-05-29T18:00:42.497264333Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}