CVE-2019-19924

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-19924
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19924.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-19924
Downstream
Related
Published
2019-12-24T16:15:11Z
Modified
2025-10-21T05:02:34.790546Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.

References

Affected packages

Git / github.com/sqlite/sqlite

Affected ranges

Type
GIT
Repo
https://github.com/sqlite/sqlite
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8654186b0236d556aa85528c2573ee0b6ab71be3

Affected versions

Other

cvs-to-fossil-cutover
experimental
fts3-refactor

version-3.*

version-3.10.0
version-3.11.0
version-3.11.1
version-3.12.0
version-3.13.0
version-3.14.0
version-3.15.0
version-3.16.0
version-3.19.0
version-3.19.1
version-3.19.2
version-3.21.0
version-3.22.0
version-3.23.0
version-3.23.1
version-3.24.0
version-3.25.0
version-3.26.0
version-3.27.0
version-3.28.0
version-3.29.0
version-3.30.0
version-3.6.10
version-3.6.15
version-3.7.10
version-3.7.11
version-3.7.12
version-3.7.12.1
version-3.7.13
version-3.7.14
version-3.7.15
version-3.7.16
version-3.7.16.1
version-3.7.16.2
version-3.7.17
version-3.7.2
version-3.7.4
version-3.7.5
version-3.7.6
version-3.7.6.1
version-3.7.7
version-3.7.8
version-3.7.9
version-3.8.0
version-3.8.1
version-3.8.10
version-3.8.10.1
version-3.8.11
version-3.8.11.1
version-3.8.2
version-3.8.3
version-3.8.4
version-3.8.4.1
version-3.8.5
version-3.8.6
version-3.8.7
version-3.8.7.1
version-3.8.8
version-3.8.9
version-3.9.0
version-3.9.1

Database specific

vanir_signatures

[
    {
        "id": "CVE-2019-19924-0cbda4f5",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 510.0,
            "function_hash": "289341195574350212391054022878281305145"
        },
        "target": {
            "function": "codeCompare",
            "file": "src/expr.c"
        },
        "source": "https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3",
        "deprecated": false
    },
    {
        "id": "CVE-2019-19924-3ebbb9e3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 3044.0,
            "function_hash": "261577890961411014898351609100443694783"
        },
        "target": {
            "function": "sqlite3WindowRewrite",
            "file": "src/window.c"
        },
        "source": "https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3",
        "deprecated": false
    },
    {
        "id": "CVE-2019-19924-556c1242",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "325699382715287326009987521307471454456",
                "270222519232114022808879911164492275075",
                "234771701567774970236996005718943768462",
                "157367755804963360587907976423518170340",
                "251448130515872088556476770431500172221",
                "144272897311174661132725549144917480053",
                "33614506948838653228691560302179833877"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "src/window.c"
        },
        "source": "https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3",
        "deprecated": false
    },
    {
        "id": "CVE-2019-19924-6d9de27b",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "11434213176979394703454359497710365439",
                "310763219010397771047909940992835381421",
                "156757343900631303322355437558628914552"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "src/expr.c"
        },
        "source": "https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3",
        "deprecated": false
    },
    {
        "id": "CVE-2019-19924-b0007590",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "215444345926076654548411634251613729759",
                "252380961147499365412023835791821933268",
                "123604298311559770011683048397407628154",
                "333404582138517325406381684493404653273"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "src/vdbeaux.c"
        },
        "source": "https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3",
        "deprecated": false
    },
    {
        "id": "CVE-2019-19924-d9b45c3a",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 465.0,
            "function_hash": "9434467424313002811330113527187731038"
        },
        "target": {
            "function": "vdbeVComment",
            "file": "src/vdbeaux.c"
        },
        "source": "https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3",
        "deprecated": false
    }
]