CVE-2019-9937

A vulnerability was found in SQLite due to a NULL pointer dereference in the fts5ChunkIterate function within sqlite3.c, where an attacker could exploit this flaw by creating a specially crafted table, causing the application to crash and resulting in a denial of service condition.

This vulnerability in the SQLite3 database engine is rated as Low Severity because of its technical nature and severely limited impact, this flaw is a NULL Pointer Dereference (CWE-476) that occurs within the code that handles full text search tables, specifically the fts5 virtual table functionality. The issue is triggered by specific, non-standard actions: interleaving read and write operations within a single database transaction when interacting with an fts5 table. While this condition can be exploited remotely by an unauthenticated user to cause the issue, the inherent mechanism of a NULL pointer dereference almost exclusively leads to a crash of the affected process. Therefore, the attack's outcome is contained to a low impact Denial of Service (DoS), meaning the database service temporarily stops working, but the attacker gains no ability to steal information, tamper with data, or execute unauthorized code on the host system.

This issue did not affect the versions of sqlite as shipped with Red Hat Enterprise Linux 6 and 7 as they did not include support for fts5.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.