The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
The product does not release or incorrectly releases a resource before it is made available for re-use.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mac_os_x | Apple | 10.10.5 (including) | 10.10.5 (including) |
| Watchos | Apple | 1.0.1 (including) | 1.0.1 (including) |
| Red Hat Enterprise Linux 7 | RedHat | sqlite-0:3.7.17-6.el7_1.1 | * |
| Sqlite | Ubuntu | artful | * |
| Sqlite | Ubuntu | lucid | * |
| Sqlite | Ubuntu | precise | * |
| Sqlite | Ubuntu | utopic | * |
| Sqlite | Ubuntu | vivid | * |
| Sqlite | Ubuntu | wily | * |
| Sqlite | Ubuntu | yakkety | * |
| Sqlite | Ubuntu | zesty | * |
| Sqlite3 | Ubuntu | lucid | * |
| Sqlite3 | Ubuntu | upstream | * |
| Sqlite3 | Ubuntu | vivid | * |
| Sqlite3 | Ubuntu | vivid/stable-phone-overlay | * |
| Sqlite3 | Ubuntu | vivid/ubuntu-core | * |