CVE Feed

    Dashboard / CVE / CVE-2019-9937

    CVE-2019-9937

    In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.

    Published:Mar 18, 2019
    Last Modified:Nov 21, 2024
    EPS:Mar 22, 2019
    EPSS Score:0.03244
    CVSS Score:7.5

    Affected Products

    Vendor
    Sqlite
    Product
    Sqlite

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-476 NULL Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-39113 (CVSS 4) — Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8b…
    CVE-2026-51292 — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51290 (CVSS 9.1) — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51295 — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51291 (CVSS 9.8) — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51293 — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51294 — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51300 (CVSS 9.1) — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51296 (CVSS 7.5) — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…
    CVE-2026-51302 (CVSS 9.8) — DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigat…

    References

    http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html
    http://www.securityfocus.com/bid/107562
    https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/
    https://security.gentoo.org/glsa/201908-09
    https://security.netapp.com/advisory/ntap-20190416-0005/
    https://sqlite.org/src/info/45c73deb440496e8
    https://usn.ubuntu.com/4019-1/
    https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html
    https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html
    http://www.securityfocus.com/bid/107562
    https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/
    https://security.gentoo.org/glsa/201908-09
    https://security.netapp.com/advisory/ntap-20190416-0005/
    https://sqlite.org/src/info/45c73deb440496e8
    https://usn.ubuntu.com/4019-1/
    https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html
    https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High