CVE-2015-3415
High
Description
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
SeverityHigh
CVSS7.5
Exploit probability91. percentile4.1%
Product
Sqlite
PublishedApr 24, 2015
First seenApr 24, 2015
Weakness typeCWE-404CWE-404
How to fix
Update
- php php5.4.42, 5.5.26, 5.6.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sqlite sqlite | v ≤ 3.8.8.3 | — |
| apple mac_os_x | 10.10.5 | — |
| apple watchos | 1.0.1 | — |
| debian debian_linux | 8.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 15.04 | — |
| php php | 5.4.0 ≤ v < 5.4.42, 5.5.0 ≤ v < 5.5.26, 5.6.0 ≤ v < 5.6.10 | 5.4.42, 5.5.26, 5.6.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.