In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-sqlite3 | Aug 24, 2020 | Mar 22, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-db-sqlite | Aug 16, 2019 | Mar 22, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-sqlitehuawei-euleros-2_0_sp8-upgrade-sqlite-develhuawei-euleros-2_0_sp8-upgrade-sqlite-dochuawei-euleros-2_0_sp8-upgrade-sqlite-libs | Feb 26, 2020 | Mar 22, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-database-sqlite-3-3-28-0-11-4-10-0-1-1-0oracle-solaris-11-4-upgrade-database-sqlite-3-documentation-3-28-0-11-4-10-0-1-1-0oracle-solaris-11-4-upgrade-runtime-tcl-8-8-6-7-11-4-10-0-1-1-0oracle-solaris-11-4-upgrade-runtime-tcl-8-tcl-sqlite-3-3-28-0-11-4-10-0-1-1-0 | Jun 26, 2019 | Mar 22, 2019 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Mar 22, 2019 |
| Suse | — | suse-upgrade-libsqlite3-0suse-upgrade-libsqlite3-0-32bitsuse-upgrade-sqlite3suse-upgrade-sqlite3-develsuse-upgrade-sqlite3-doc | May 11, 2019 | Mar 22, 2019 |
| Ubuntu | ubuntu-upgrade-libsqlite3-0ubuntu-upgrade-sqlite3 | Jun 20, 2019 | Mar 22, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub