What’s Vulnerable › Vulnerabilities

CVE-2019-19959

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-03 · updated 2026-10-14

Description

ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 19.10
• SQLite: 3.30.1

References

• https://github.com/sqlite/sqlite/commit/1e490c4ca6b43a9cf8637d695907888349f69bec
• https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1
• https://security.netapp.com/advisory/ntap-20200204-0001/
• https://usn.ubuntu.com/4298-1/
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://github.com/sqlite/sqlite/commit/1e490c4ca6b43a9cf8637d695907888349f69bec
• https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1
• https://security.netapp.com/advisory/ntap-20200204-0001/
• https://usn.ubuntu.com/4298-1/
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2019-19959 or the next vulnerability affects your stack