CVE-2019-16168 is a medium-severity vulnerability in SQLite versions up to 3.29.0, affecting numerous products including Canonical, Debian, and Oracle. It involves a missing validation in the sqlite_stat1 sz field, leading to a "severe division by zero" error in the query planner that can crash applications. The vulnerability has a CVSS score of 6.5, indicating it can be exploited remotely with low attack complexity, resulting in high availability impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.8.5, <= 3.29.0CPE matchmatch criteria | cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* | ||
>= 7.3CPE matchmatch criteria | cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* | ||
>= 9.5CPE matchmatch criteria | cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* | ||
>= 11.0.0, <= 11.60.3CPE matchmatch criteria | cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-16168
Jun 11, 2024In SQLite through 3.29.0 whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field aka a "severe division by zero in the query planner."
Sep 10, 2019sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c
Aug 15, 2019