USN-4298-1: SQLite vulnerabilities
sqlite3 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary
Several security issues were fixed in SQLite.
Software Description
- sqlite3 – C library that implements an SQL database engine
Details
It was discovered that SQLite incorrectly handled certain shadow tables. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-13734,
CVE-2019-13750, CVE-2019-13753)
It was discovered that SQLite incorrectly handled certain corrupt records.
An attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-13751)
It was discovered that SQLite incorrectly handled certain queries. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 19.10. (CVE-2019-19880)
It was discovered that SQLite incorrectly handled certain queries. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-19923)
It was discovered that SQLite incorrectly handled parser tree rewriting. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 19.10. (CVE-2019-19924)
It was discovered that SQLite incorrectly handled certain ZIP archives. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-19925,
CVE-2019-19959)
It was discovered that SQLite incorrectly handled errors during parsing. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-19926)
It was discovered that SQLite incorrectly handled parsing errors. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-20218)
It was discovered that SQLite incorrectly handled generated column
optimizations. An attacker could use this issue to cause SQLite to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2020-9327)
Update instructions
The problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- libsqlite3-0 – 3.29.0-2ubuntu0.2
- sqlite3 – 3.29.0-2ubuntu0.2
- Ubuntu 18.04 LTS
- libsqlite3-0 – 3.22.0-1ubuntu0.3
- sqlite3 – 3.22.0-1ubuntu0.3
- Ubuntu 16.04 LTS
- libsqlite3-0 – 3.11.0-1ubuntu1.4
- sqlite3 – 3.11.0-1ubuntu1.4
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
Leave a Reply