CVE-2017-15286 SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where sqlite3_step(pStmt)==SQLITE_ROW is false and a data structure is never initi...
HighCVSS 7.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where sqlite3_step(pStmt)==SQLITE_ROW is false and a data structure is never initialized.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sqlite3(Debian:12) | < 3.20.1-2 | 3.20.1-2 |
| debian/sqlite3(Debian:13) | < 3.20.1-2 | 3.20.1-2 |
| debian/sqlite3(Debian:14) | < 3.20.1-2 | 3.20.1-2 |
| SQLite | = 3.20.1 | No fix listed |
| alpine/sqlite(Alpine:v3.6) | < 3.20.1-r1 | 3.20.1-r1 |
References
- Debian Security Tracker CVE-2017-15286 vendor-advisory
- 101285 third-party-advisory vdb-entry
- github.com exploit third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking