UBUNTU-CVE-2019-9937
- Source
- https://ubuntu.com/security/CVE-2019-9937
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-9937.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-9937
- Upstream
- Downstream
- Related
- Published
- 2019-03-22T00:00:00Z
- Modified
- 2025-09-08T16:45:21Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Ubuntu - low
- Summary
- [none]
- Details
-
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5hash.c and ext/fts5/fts5index.c.
- References
-
- https://ubuntu.com/security/CVE-2019-9937
- https://sqlite.org/src/info/45c73deb440496e8
- https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114383.html
- https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114393.html
- https://ubuntu.com/security/notices/USN-4019-1
- https://www.cve.org/CVERecord?id=CVE-2019-9937
Affected packages
Ubuntu:16.04:LTS / sqlite3
Package
- Name
- sqlite3
- Purl
- pkg:deb/ubuntu/sqlite3@3.11.0-1ubuntu1.2?arch=source&distro=xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.11.0-1ubuntu1.2
Affected versions
3.*
3.8.11.1-1
3.9.1-2
3.9.2-1
3.10.0-1
3.10.1-1
3.10.2-1
3.11.0-1ubuntu1
3.11.0-1ubuntu1.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "3.11.0-1ubuntu1.2",
"binary_name": "lemon"
},
{
"binary_version": "3.11.0-1ubuntu1.2",
"binary_name": "libsqlite3-0"
},
{
"binary_version": "3.11.0-1ubuntu1.2",
"binary_name": "libsqlite3-dev"
},
{
"binary_version": "3.11.0-1ubuntu1.2",
"binary_name": "libsqlite3-tcl"
},
{
"binary_version": "3.11.0-1ubuntu1.2",
"binary_name": "sqlite3"
}
]
}
Ubuntu:18.04:LTS / sqlite3
Package
- Name
- sqlite3
- Purl
- pkg:deb/ubuntu/sqlite3@3.22.0-1ubuntu0.1?arch=source&distro=bionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.22.0-1ubuntu0.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "3.22.0-1ubuntu0.1",
"binary_name": "lemon"
},
{
"binary_version": "3.22.0-1ubuntu0.1",
"binary_name": "libsqlite3-0"
},
{
"binary_version": "3.22.0-1ubuntu0.1",
"binary_name": "libsqlite3-dev"
},
{
"binary_version": "3.22.0-1ubuntu0.1",
"binary_name": "libsqlite3-tcl"
},
{
"binary_version": "3.22.0-1ubuntu0.1",
"binary_name": "sqlite3"
}
]
}