SQLite vulnerabilities

An issue was discovered in certain Apple products related to the 'SQLite' component. Affects iOS before 11, macOS before 10.13, iCloud before 7.0 on Windows, tvOS before 11, and watchOS before 4.

SQLite version 3.20.1 has a NULL pointer dereference in the tableColumnList function in shell.c. This issue occurs because certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false are not considered, leading to an uninitialized data structure.

An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, involving the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.

An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, related to the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.

Multiple unspecified vulnerabilities in SQLite before version 3.8.10.2, as used in Apple iOS before version 9, may lead to unknown impact and attack vectors.

Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash).

The sqlite3VXPrintf function in SQLite before version 3.8.9 does not properly handle precision and width values during floating-point conversions, which can lead to integer overflow and stack-based buffer overflow. Attackers can exploit this in context to cause denial of service or potentially other unspecified impacts.

The sqlite3VdbeExec function in SQLite before version 3.8.9 does not properly implement comparison operators, allowing attackers to cause a denial of service or potentially other unspecified impacts via a crafted CHECK clause.

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, allowing context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause.

SQLite 'sqldiff.exe' does not securely handle Unicode to ANSI codepage conversion on Windows, allowing an attacker to load an arbitrary DLL via the '-L' option and misinterpret command line arguments.

An integer overflow can be triggered in SQLite's concat_ws() function. The resulting truncated integer is used to allocate a buffer, but the original untruncated size is used when writing the resulting string, leading to a heap buffer overflow of about 4GB that can result in arbitrary code execution.

In SQLite 3.31.1, there is an out-of-bounds access problem through ALTER TABLE for views that have a nested FROM clause.

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. The vendor disputes the relevance because a sqlite3.exe user already has full privileges, and this does not imply any problem in the SQLite library.

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

In SQLite 3.30.1, zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive, potentially leading to unexpected behavior.

SQLite 3.30.1 mishandles parser-tree rewriting in the sqlite3WindowRewrite() function, affecting expr.c, vdbeaux.c, and window.c. The vulnerability is caused by incorrect error handling during window query rewriting.

In SQLite 3.30.1, flattenSubquery in select.c mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN where the right-hand side is a view, which can cause a NULL pointer dereference or incorrect results.

In SQLite 3.30.1, multiSelect in select.c mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. This vulnerability exists because of an incomplete fix for CVE-2019-19880.

In SQLite 3.30.1, exprListAppendList in window.c mishandles constant integer values in ORDER BY clauses of window definitions, which can trigger an invalid pointer dereference.

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

In SQLite 3.26.0, a use-after-free vulnerability exists in the window function functionality, which can be exploited via a specially crafted SQL command, potentially resulting in remote code execution.

In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c.

In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak.

An issue was discovered in certain Apple products, including iOS before 11, macOS before 10.13, tvOS before 11, and watchOS before 4, related to the third-party product 'SQLite'. Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

An issue was discovered in certain Apple products, including iOS before 11, macOS before 10.13, tvOS before 11, and watchOS before 4, related to the third-party 'SQLite' product. Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

An issue was discovered in certain Apple products, including iOS before 11, macOS before 10.13, tvOS before 11, and watchOS before 4, related to the third-party 'SQLite' product. Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

An issue was discovered in certain Apple products related to the 'SQLite' component. This affects iOS versions before 10.3.2, macOS versions before 10.12.5, tvOS versions before 10.2.1, and watchOS versions before 3.2.2.

An issue was discovered in certain Apple products related to the 'SQLite' component. Affects iOS before 10.3.2, macOS before 10.12.5, tvOS before 10.2.1, and watchOS before 3.2.2. This issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted SQL statement.

An issue was discovered in certain Apple products related to the 'SQLite' component. This affects iOS versions before 10.3.2, macOS versions before 10.12.5, tvOS versions before 10.2.1, and watchOS versions before 3.2.2.

An issue was discovered in certain Apple products, involving the 'SQLite' component. iOS versions before 10.3.2, macOS before 10.12.5, tvOS before 10.2.1, and watchOS before 3.2.2 are vulnerable to a use-after-free vulnerability that can lead to arbitrary code execution or application crashes.

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow in sqlite3changeset_apply(). An attacker can corrupt heap memory by supplying crafted changesets where repeating a table name in a second changeset block with a larger column count causes sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension. An attacker can make applications use freed heap memory by manipulating the %_node shadow table, leading to a process crash.

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows bypassing the SQLITE_LIMIT_EXPR_DEPTH limit via chained COLLATE operators. An attacker can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view, triggering unbounded recursion and a process crash.

SQLite before 3.54.0 contains an information disclosure vulnerability that allows reading uninitialized page-cache memory by supplying a WAL file with an undersized page size. An attacker can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete(). An attacker can write past the leaf page buffer via crafted footer key offsets by supplying a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. An attacker who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. An attacker can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows bypassing the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. An attacker can supply a WITH clause chaining tens of thousands of CTEs, causing unbounded selectExpander() recursion and a process crash.

Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.

A buffer overflow vulnerability in SQLite affects source snapshots/builds containing a specific Fossil check-in. An attacker can exploit this to cause a denial of service via components related to the sqlar_uncompress function.

A vulnerability in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path.