CVE-2019-9937

HIGH 7.5CVE-2019-9937 · Published 22/03/2019 · updated 14/10/2026

In short

CVE-2019-9937 is a HIGH (CVSS 7.5) vulnerability affecting sqlite (sqlite).
Chance of exploitation in the next 30 days (EPSS): 6.1%, higher than 93.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
sqlite sqlite	`= 3.27.2`	No fix yet

Description

In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.

References

lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html
securityfocus.com/bid/107562 · Third Party Advisory
lists.debian.org/debian-lts-announce/2020/08/msg00037.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP
security.gentoo.org/glsa/201908-09
security.netapp.com/advisory/ntap-20190416-0005 · Third Party Advisory
sqlite.org/src/info/45c73deb440496e8 · Patch
usn.ubuntu.com/4019-1
mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html
mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html

More vulnerabilities in sqlite

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free