CVE-2019-9937

Red Hat statement

This vulnerability in the SQLite3 database engine is rated as Low Severity because of its technical nature and severely limited impact, this flaw is a NULL Pointer Dereference (CWE-476) that occurs within the code that handles full text search tables, specifically the fts5 virtual table functionality. The issue is triggered by specific, non-standard actions: interleaving read and write operations within a single database transaction when interacting with an fts5 table. While this condition can be exploited remotely by an unauthenticated user to cause the issue, the inherent mechanism of a NULL pointer dereference almost exclusively leads to a crash of the affected process. Therefore, the attack's outcome is contained to a low impact Denial of Service (DoS), meaning the database service temporarily stops working, but the attacker gains no ability to steal information, tamper with data, or execute unauthorized code on the host system. This issue did not affect the versions of sqlite as shipped with Red Hat Enterprise Linux 6 and 7 as they did not include support for fts5.