{"id":"CVE-2019-9936","aliases":["BELL-CVE-2019-9936","CLSA-2026-1785562610","CLSA-2026-1785563058","DEBIAN-CVE-2019-9936","DLA-2340-1","EUVD-2019-19291","GHSA-pr9h-5886-9mvw","MGASA-2019-0240","SUSE-SU-2019:1127-1","UBUNTU-CVE-2019-9936","USN-4019-1","openSUSE-SU-2019:1372-1","openSUSE-SU-2024:11400-1"],"status":"published","title":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based...","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0535,"percentile":0.92689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-03-22T00:00:00Z","modified":"2026-11-04T02:30:56Z","fixes":[{"ecosystem":"Debian:12","package":"sqlite3","fixed_in":["3.27.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.27.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.27.2-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"sqlite3","fixed_in":["3.11.0-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","fixed_in":["3.22.0-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.2-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.2-5+deb9u2"}]}],"versions":["3.16.2-5","3.16.2-5+deb9u1"],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.2"}]}],"versions":["3.8.11.1-1","3.9.1-2","3.9.2-1","3.10.0-1","3.10.1-1","3.10.2-1","3.11.0-1ubuntu1","3.11.0-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-1ubuntu0.1"}]}],"versions":["3.19.3-3","3.20.1-2","3.21.0-1","3.22.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.2"}]}],"versions":["3.8.11.1-1","3.9.1-2","3.9.2-1","3.10.0-1","3.10.1-1","3.10.2-1","3.11.0-1ubuntu1","3.11.0-1ubuntu1.1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-1ubuntu0.1"}]}],"versions":["3.19.3-3","3.20.1-2","3.21.0-1","3.22.0-1"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-lp150.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1.2"}]}],"bundled":10}],"products":[{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://sqlite.org/src/info/b3fa58dd7403dbd4","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/107562","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4019-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201908-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9936","tags":["advisory"]},{"url":"https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114382.html","tags":["report"]},{"url":"https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114394.html","tags":["report"]},{"url":"https://usn.ubuntu.com/4019-1"},{"url":"https://security.netapp.com/advisory/ntap-20190416-0005"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO"},{"url":"https://github.com/advisories/GHSA-pr9h-5886-9mvw"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-9936","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1785562610.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9937","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1785563058.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9936","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0240.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24750","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191127-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1130325","tags":["report"]},{"url":"https://bugzilla.suse.com/1130326","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9937","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-9936","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4019-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9937","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J7DCGW2ODM5NG4OPDL4YIFF2AJQHYWFM/#J7DCGW2ODM5NG4OPDL4YIFF2AJQHYWFM","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13871","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-9936","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","status":"published","published":"2019-03-22T07:07:04Z","modified":"2026-11-02T17:51:34.338Z","updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2019-19291","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","status":"published","published":"2019-03-22T07:07:04Z","modified":"2026-11-02T17:51:34Z","updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-pr9h-5886-9mvw","title":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based...","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","status":"published","published":"2022-05-13T01:23:09Z","modified":"2026-10-14T09:31:21Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2019-9936","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","status":"published","published":"2019-03-22T08:29:00.607Z","modified":"2026-11-02T18:18:27.98Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"BELL-CVE-2019-9936","title":"CVE-2019-9936 does not affect BellSoft software","status":"withdrawn","published":"2019-03-22T08:29:00Z","modified":"2026-01-26T09:49:41.791581Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-9936","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","status":"published","published":"2019-03-22T08:29:00.607Z","modified":"2026-11-04T02:30:56.600668792Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"DEBIAN-CVE-2019-9936","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","status":"published","published":"2019-03-22T08:29:00.607Z","modified":"2026-11-03T09:47:40.1721674Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"UBUNTU-CVE-2019-9936","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.","status":"published","published":"2019-03-22T00:00:00Z","modified":"2026-04-22T12:24:12.245657Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"CLSA-2026-1785562610","title":"sqlite: Fix of 3 CVEs","description":"- CVE-2019-9937: fix fts5 index corruption when reads and writes are\n  interleaved within a single transaction\n- CVE-2019-9936: fix heap-based buffer over-read in fts5HashEntrySort()\n  when running fts5 prefix queries inside a transaction\n- CVE-2019-19244: fix invalid Mem object when a sub-select uses both\n  DISTINCT and window functions with an ORDER BY matching its select list","status":"published","published":"2026-08-01T05:37:07Z","modified":"2026-10-26T09:43:48.953876945Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785563058","title":"sqlite: Fix of 3 CVEs","description":"- CVE-2019-9937: fix fts5 index corruption when reads and writes are\n  interleaved within a single transaction\n- CVE-2019-9936: fix heap-based buffer over-read in fts5HashEntrySort()\n  when running fts5 prefix queries inside a transaction\n- CVE-2019-19244: fix invalid Mem object when a sub-select uses both\n  DISTINCT and window functions with an ORDER BY matching its select list","status":"published","published":"2026-08-01T05:44:31Z","modified":"2026-10-26T09:43:37.54698132Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"DLA-2340-1","title":"sqlite3 - security update","status":"published","published":"2020-08-22T00:00:00Z","modified":"2026-03-09T01:23:17.285848Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2019-0240","title":"Updated sqlite3 packages fix security vulnerabilities","description":"Updated sqlite3 packages fix security vulnerabilities:\n\nIt was discovered that SQLite incorrectly handled certain inputs. An\nattacker could possibly use this issue to access sensitive information\n(CVE-2019-8457).\n\nIt was discovered that SQLite incorrectly handled certain queries. An\nattacker could possibly use this issue to access sensitive information\n(CVE-2019-9936).\n\nIt was discovered that SQLite incorrectly handled certain inputs. An\nattacker could possibly use this issue to cause a crash or execute\narbitrary code (CVE-2019-9937).\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:43:53.137547632Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1372-1","title":"Security update for sqlite3","description":"This update for sqlite3 to version 3.28.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9936: Fixed a heap-based buffer over-read, when running fts5 prefix\n  queries inside transaction (bsc#1130326).\n- CVE-2019-9937: Fixed a denial of service related to interleaving reads and writes in\n  a single transaction with an fts5 virtual table (bsc#1130325).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-10T11:28:27Z","modified":"2026-02-04T03:38:25.877748Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11400-1","title":"libsqlite3-0-3.36.0-1.2 on GA media","description":"These are all security issues fixed in the libsqlite3-0-3.36.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:18.788761Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:1127-1","title":"Security update for sqlite3","description":"This update for sqlite3 to version 3.28.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9936: Fixed a heap-based buffer over-read, when running fts5 prefix\n  queries inside transaction (bsc#1130326).\n- CVE-2019-9937: Fixed a denial of service related to interleaving reads and writes in\n  a single transaction with an fts5 virtual table (bsc#1130325).\n","status":"published","published":"2019-05-02T07:39:27Z","modified":"2026-02-04T03:58:47.774662Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-4019-1","title":"sqlite3 vulnerabilities","description":"It was discovered that SQLite incorrectly handled certain SQL files.\nAn attacker could possibly use this issue to execute arbitrary code\nor cause a denial of service. This issue only affected Ubuntu 16.04\nLTS. (CVE-2017-2518, CVE-2017-2520)\n\nIt was discovered that SQLite incorrectly handled certain queries.\nAn attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20505)\n\nIt was discovered that SQLite incorrectly handled certain queries.\nAn attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and\nUbuntu 18.10. (CVE-2018-20346, CVE-2018-20506)\n\nIt was discovered that SQLite incorrectly handled certain inputs.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2019-8457)\n\nIt was discovered that SQLite incorrectly handled certain queries.\nAn attacker could possibly use this issue to access sensitive information.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10.\n(CVE-2019-9936)\n\nIt was discovered that SQLite incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a crash or execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS\nand Ubuntu 18.10. (CVE-2019-9937)\n\nIt was discovered that SQLite incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)\n\nIt was discovered that SQLite incorrectly handled certain databases.\nAn attacker could possibly use this issue to access sensitive information.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)\n\nIt was discovered that SQLite incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)\n\nIt was discovered that SQLite incorrectly handled certain queries.\nAn attacker could possibly use this issue to execute arbitrary code or\ncause a denial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2017-2519)\n","status":"published","published":"2019-06-19T15:32:19Z","modified":"2026-04-27T15:33:01.614694005Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}