Lucene search

K
ubuntucveUbuntu.comUB:CVE-2019-5018
HistoryMay 10, 2019 - 12:00 a.m.

CVE-2019-5018

2019-05-1000:00:00
ubuntu.com
ubuntu.com
6

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.112 Low

EPSS

Percentile

95.1%

An exploitable use after free vulnerability exists in the window function
functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause
a use after free vulnerability, potentially resulting in remote code
execution. An attacker can send a malicious SQL command to trigger this
vulnerability.

Notes

Author Note
leosilva code was introduced in 3.25.0
mdeslaur need to be able to execute arbitrary SQL commands to trigger this issue.
OSVersionArchitecturePackageVersionFilename
ubuntu19.04noarchsqlite3< 3.27.2-2ubuntu0.2UNKNOWN
ubuntu19.10noarchsqlite3< 3.27.2-3UNKNOWN

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.112 Low

EPSS

Percentile

95.1%

Related for UB:CVE-2019-5018