CVE-2017-15286

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/101285Third Party Advisory, VDB Entry
https://github.com/Ha0Team/crash-of-sqlite3/blob/master/poc.mdExploit, Third Party Advisory
http://www.securityfocus.com/bid/101285Third Party Advisory, VDB Entry
https://github.com/Ha0Team/crash-of-sqlite3/blob/master/poc.mdExploit, Third Party Advisory

Timeline

Published: Oct 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-152876.1There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the CVE-2017-152887.8The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /t CVE-2017-152896.0The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-CVE-2017-152907.5Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data CVE-2017-152916.1Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows remote attackers to CVE-2017-152939.8Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or c CVE-2017-152946.1The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.CVE-2017-152959.8Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064.CVE-2017-152968.8The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964.CVE-2017-152977.5SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993.CVE-2017-152985.5Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a CVE-2017-152995.5The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which a