CVE-2015-3415 The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free oper...
HighCVSS 7.5
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sqlite3(Debian:12) | < 3.8.9-1 | 3.8.9-1 |
| debian/sqlite3(Debian:13) | < 3.8.9-1 | 3.8.9-1 |
| debian/sqlite3(Debian:14) | < 3.8.9-1 | 3.8.9-1 |
| apple mac os x | = 10.10.5 | No fix listed |
| apple watchOS | = 1.0.1 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| SQLite | <= 3.8.8.3 | No fix listed |
| PHP | >= 5.4.0, < 5.4.42 | 5.4.42 |
| PHP | >= 5.5.0, < 5.5.26 | 5.5.26 |
| PHP | >= 5.6.0, < 5.6.10 | 5.6.10 |
References
- Debian Security Tracker CVE-2015-3415 vendor-advisory
- APPLE-SA-2015-09-21-1 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2015-09-30-3 mailing-list third-party-advisory vendor-advisory
- RHSA-2015:1635 third-party-advisory vendor-advisory
- 20150414 several issues in SQLite (+ catching up on several other bugs) mailing-list third-party-advisory vdb-entry
- DSA-3252 third-party-advisory vendor-advisory
- MDVSA-2015:217 broken-link vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- 74228 third-party-advisory vdb-entry
- 1033703 third-party-advisory vdb-entry
- USN-2698-1 third-party-advisory vendor-advisory
- GLSA-201507-05 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- www.sqlite.org vendor-advisory
- PHP 5.4.42 Released vendor-advisory
- bugs.debian.org issue-tracking