CVE-2015-3414
High
Description
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
SeverityHigh
CVSS7.5
Exploit probability91. percentile4.1%
Product
Sqlite
PublishedApr 24, 2015
First seenApr 24, 2015
Weakness typeCWE-908CWE-908
How to fix
Update
- php php5.4.42, 5.5.26, 5.6.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sqlite sqlite | v ≤ 3.8.8.3 | — |
| apple mac_os_x | 10.10.5 | — |
| apple watchos | 1.0.1 | — |
| debian debian_linux | 8.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 15.04 | — |
| php php | 5.4.0 ≤ v < 5.4.42, 5.5.0 ≤ v < 5.5.26, 5.6.0 ≤ v < 5.6.10 | 5.4.42, 5.5.26, 5.6.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.