Home > Vulnerability Database > CVE-2019-19880

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2019-19880

Date: December 18, 2019

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

Language: C

Severity Score

7.5

Related Resources (15)

Url: https://usn.ubuntu.com/4298-1/

Url: https://www.oracle.com/security-alerts/cpuapr2020.html

Url: https://security-tracker.debian.org/tracker/CVE-2019-19880

Url: https://access.redhat.com/errata/RHSA-2020:0514

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19880

Url: https://nvd.nist.gov/vuln/detail/CVE-2019-19880

Url: https://www.debian.org/security/2020/dsa-4638

Url: https://access.redhat.com/security/cve/CVE-2019-19880

Url: https://security.netapp.com/advisory/ntap-20200114-0001/

Url: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html

Url: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Url: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html

Url: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html

Url: https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54

Url: https://www.mend.io/vulnerability-database/CVE-2019-19880

Severity Score

7.5

Weakness Type (CWE)

NULL Pointer Dereference

CWE-476

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us