CVE-2017-15286
HighSummary
SQLite version 3.20.1 has a NULL pointer dereference in the tableColumnList function in shell.c. This issue occurs because certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false are not considered, leading to an uninitialized data structure.
Risk Assessment
This bug may lead to application crashes using SQLite, potentially affecting service availability and system stability.
Recommendation
It is recommended to update SQLite to the latest version to mitigate this vulnerability and minimize the risk of application errors.
Other vulnerabilities in SQLite 3.20.1
See all- CVE-2017-7127High
An issue was discovered in certain Apple products related to the 'SQLite' component. Affects iOS before 11, macOS before 10.13, iCloud before 7.0 on Windows, tvOS before 11, and watchOS before 4.
- CVE-2017-6991High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, involving the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
- CVE-2017-6983High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, related to the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
- CVE-2015-5895High
Multiple unspecified vulnerabilities in SQLite before version 3.8.10.2, as used in Apple iOS before version 9, may lead to unknown impact and attack vectors.
- CVE-2015-3717High
Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash).
- CVE-2015-3416High
The sqlite3VXPrintf function in SQLite before version 3.8.9 does not properly handle precision and width values during floating-point conversions, which can lead to integer overflow and stack-based buffer overflow. Attackers can exploit this in context to cause denial of service or potentially other unspecified impacts.
- CVE-2015-3415High
The sqlite3VdbeExec function in SQLite before version 3.8.9 does not properly implement comparison operators, allowing attackers to cause a denial of service or potentially other unspecified impacts via a crafted CHECK clause.
- CVE-2015-3414High
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, allowing context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause.
- CVE-2019-19603High
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
- CVE-2019-19645Medium
A vulnerability in SQLite up to version 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
Original NVD description (English source)
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.