Use-after-free in SQLite - CVE-2019-5018

Vulnerability identifier: #VU18645

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5018

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the window function functionality. A remote attacker can send a specially crafted SQL command to the application, trigger user-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

SQLite
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
busybox (Alpine package)
sqlite3 (Ubuntu package)
sqlite (Alpine package)
sqlite (Red Hat package)
firefox-esr (Alpine package)
Red Hat OpenShift Serverless
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install updates from vendor's website.

SQLite - update to 3.27.1
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.11.0, 1.12.0
Quay - update to 3.3.3
sqlite3 (Ubuntu package) - addressed in versions 3.11.0-1ubuntu1.3, 3.22.0-1ubuntu0.2, 3.27.2-2ubuntu0.2, 3.29.0-2ubuntu0.1
sqlite (Alpine package) - update to 3.28.0-r0
sqlite (Red Hat package) - update to 3.26.0-11.el8

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0777

• Use-after-free in Sqlite
• Gentoo update for SQLite
• Ubuntu update for SQLite
• Use-after-free in sqlite (Alpine package)
• Use-after-free in busybox (Alpine package)
• Red Hat Enterprise Linux 8 update for sqlite
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Use-after-free in firefox-esr (Alpine package)
• Multiple vulnerabilities in Red Hat OpenShift Serverless