What’s Vulnerable › Vulnerabilities

CVE-2019-19880

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-18 · updated 2026-10-14
• Weakness: CWE-476

Description

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

Affected products

• Debian Linux: 9.0, 10.0
• NetApp Cloud Backup: all versions
• openSUSE Backports Sle: 15.0-sp1
• openSUSE Leap: 15.1
• Oracle Corporation MySQL Workbench: through 8.0.19
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Workstation: 6.0
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
• SQLite: 3.30.1
• SUSE Package Hub: all versions

How to fix

Upgrade to a fixed version: Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
• https://access.redhat.com/errata/RHSA-2020:0514
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54
• https://security.netapp.com/advisory/ntap-20200114-0001/
• https://usn.ubuntu.com/4298-1/
• https://www.debian.org/security/2020/dsa-4638
• https://www.oracle.com/security-alerts/cpuapr2020.html
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html

Get alerted when CVE-2019-19880 or the next vulnerability affects your stack