Out of Bounds Read Vulnerability in SQLite - CVE-2019-13753
Summary
UBUNTU-CVE-2019-13753: Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Affects sqlite3 versions < 3.8.2-1ubuntu2.2+esm2. Fixed in 3.8.2-1ubuntu2.2+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a widely used relational database management system that is embedded in applications. It is known for its lightweight nature and ease of integration. The vulnerability CVE-2019-13753 affects SQLite versions used in various applications, including Google Chrome, allowing attackers to exploit an out-of-bounds read condition, potentially leading to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from an out-of-bounds read in SQLite within Google Chrome prior to version 79.0.3945.79. This flaw allows remote attackers to craft a malicious HTML page that, when accessed, can lead to the exposure of sensitive information from the process memory. The implications of this vulnerability are significant, as it can compromise user data and privacy, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.8.2-1ubuntu2.2+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlite3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid accessing untrusted HTML pages that may exploit this vulnerability until the package is updated.
Conclusion
CVE-2019-13753 is a critical vulnerability in SQLite that poses a risk of exposing sensitive information through an out-of-bounds read. Users are strongly encouraged to update their packages to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for sqlite3 →
FAQ
CVE-2019-13753 is a vulnerability in SQLite that allows an out-of-bounds read, potentially exposing sensitive information.
The vulnerability affects SQLite versions prior to 79.0.3945.79 in Google Chrome.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2019-13753 is 6.5, indicating a medium severity level.
If immediate updates are not possible, avoid visiting untrusted websites that may exploit this vulnerability until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite3.
