CVE-2019-9936
Full vulnerability record from the local CVENow database.
Description
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.
Severity
HIGH
CVSS score
7.5
(v3.0)
Vulnerability status
Modified
Source identifier
Published
2019-03-22 08:29:00.607000
Last modified
2026-11-02 18:18:27.980000
View original CVE JSON
{
"id": "CVE-2019-9936",
"sourceIdentifier": "[email protected]",
"published": "2019-03-22T08:29:00.607",
"lastModified": "2026-11-02T18:18:27.980",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c."
},
{
"lang": "es",
"value": "En SQLite 3.27.2, la ejecución de las consultas de prefijo fts5 en una transacción podría desencadenar una sobrelectura de búfer basada en memoria dinámica (heap) en fts5HashEntrySort en sqlite3.c, lo que podría conducir a una fuga de información. Esto está relacionado con ext/fts5/fts5_hash.c."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"version": "n/a",
"status": "affected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"baseScore": 5.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-02T17:51:19.830649Z",
"id": "CVE-2019-9936",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sqlite:sqlite:3.27.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C1D25C0F-15FD-444C-A0BC-D390862CFD15"
}
]
}
]
}
],
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html",
"source": "[email protected]"
},
{
"url": "http://www.securityfocus.com/bid/107562",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html",
"source": "[email protected]"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/",
"source": "[email protected]"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/",
"source": "[email protected]"
},
{
"url": "https://security.gentoo.org/glsa/201908-09",
"source": "[email protected]"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190416-0005/",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://sqlite.org/src/info/b3fa58dd7403dbd4",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://usn.ubuntu.com/4019-1/",
"source": "[email protected]"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html",
"source": "[email protected]"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html",
"source": "[email protected]"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
"source": "[email protected]"
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"source": "[email protected]"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/107562",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201908-09",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190416-0005/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://sqlite.org/src/info/b3fa58dd7403dbd4",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://usn.ubuntu.com/4019-1/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}