Back to Database
Status published
Unknown
CVE-2019-16168
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a...
Vulnerability Description
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-16168
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html
- https://www.sqlite.org/src/timeline?c=98357d8c1263920b
- https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62
- https://security.netapp.com/advisory/ntap-20190926-0003/
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html
- https://usn.ubuntu.com/4205-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.netapp.com/advisory/ntap-20200122-0003/
- https://security.gentoo.org/glsa/202003-16
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
- https://www.tenable.com/security/tns-2021-08
- https://www.tenable.com/security/tns-2021-11
- https://www.tenable.com/security/tns-2021-14
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
More from sqlite
View All →CVE-2022-46908
SQLite through 3.40.0, when relying on --safe for execution of...
Unknown
0
CVE-2022-35737
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds...
Unknown
0
CVE-2021-45346
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1...
Medium
4.3
CVE-2021-36690
A segmentation fault can occur in the sqlite3.exe command-line component...
High
7.5
CVE-2021-31239
An issue found in SQLite SQLite3 v.3.35.4 that allows a...
Unknown
0
Affected Vendor
sqlite
View all reports →Affected Software
sqlite, active iq unified manager, e-series santricity os controller, oncommand insight, oncommand workflow automation, ontap select deploy administration utility, santricity unified manager, steelstore cloud integrated storage, ubuntu linux, fedora, debian linux, nessus agent, communications design studio, jdk, jre, mysql, outside in technology, solaris, zfs storage appliance, policy auditor
Vulnerable Versions:
3.8.5, 7.3, 9.5, 11.0.0, 12.04, 16.04, 18.04, 19.04, 19.10, 30, 9.0, 0, 7.3.4.3.0, 7.3.5.5.0, 7.4.0.4.0, 1.8.0, 8.0.0, 8.5.4, 11, 8.8
Timeline
Official Publish:
September 9th, 2019
Last Modified:
May 28th, 2026
Added to House:
July 20th, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.