CVE-2015-3416

2015-04-2417:59:00

CWE-190

[email protected]

web.nvd.nist.gov

116

cve-2015-3416

sqlite

printf.c

denial of service

buffer overflow

nvd

8.9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.5%

JSON

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

CPENameOperatorVersion
canonical:ubuntu_linuxcanonical ubuntu linuxeq12.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq15.04
sqlite:sqlitesqlitele3.8.8.3
debian:debian_linuxdebian debian linuxeq8.0
apple:mac_os_xapple mac os xle10.6.8
apple:watchosapple watchosle1.0.1
php:phpphplt5.5.26
php:phpphplt5.6.10
php:phpphplt5.4.42

CPE	Name	Operator	Version
canonical:ubuntu_linux	canonical ubuntu linux	eq	12.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	15.04
sqlite:sqlite	sqlite	le	3.8.8.3
debian:debian_linux	debian debian linux	eq	8.0
apple:mac_os_x	apple mac os x	le	10.6.8
apple:watchos	apple watchos	le	1.0.1
php:php	php	lt	5.5.26
php:php	php	lt	5.6.10
php:php	php	lt	5.4.42