NULL pointer dereference in SQLite - CVE-2019-9937

Vulnerability identifier: #VU18060

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9937

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error when processing interleaving reads and writes in a single transaction with an fts5 virtual table in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c. A remote attacker can perform a denial of service (DoS) attack.

SQLite
Gentoo Linux
Opensuse
Fedora
Netezza Appliance
Dell PowerProtect Cyber Recovery
sqlite3 (Ubuntu package)
sqlite
Autodesk Infraworks
Dell EMC Container Storage Modules

Install update from vendor's website.

SQLite - update to 3.27.2
Netezza Appliance - update to 1.0.0.1
sqlite3 (Ubuntu package) - addressed in versions 3.11.0-1ubuntu1.2, 3.22.0-1ubuntu0.1, 3.24.0-1ubuntu0.1, 3.27.2-2ubuntu0.1
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
Dell EMC Container Storage Modules - update to 1.7.0
sqlite - addressed in versions 3.26.0-3.fc29, 3.26.0-5.fc30
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• https://sqlite.org/src/info/45c73deb440496e8
• https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114383.html
• https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114393.html

• Multiple vulnerabilities in SQLite
• OpenSUSE Linux update for sqlite3
• Gentoo update for SQLite
• Ubuntu update for SQLite
• Multiple vulnerabilities in Dell EMC Cyber Recovery
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in Dell Container Storage Modules
• Fedora 30 update for sqlite
• Fedora 29 update for sqlite
• Multiple vulnerabilities in IBM Netezza Appliance