{"schema_version":"1.8.0","id":"CVE-2019-19959","published":"2020-01-03T22:15:12.550Z","modified":"2026-08-07T14:52:59.398382Z","related":["SUSE-SU-2021:2320-1","SUSE-SU-2021:3215-1","openSUSE-SU-2021:1058-1","openSUSE-SU-2021:2320-1"],"details":"ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sqlite/sqlite","events":[{"introduced":"25e9591209453dc0904f8f0f1c4d5090c836e19b"},{"last_affected":"25e9591209453dc0904f8f0f1c4d5090c836e19b"},{"fixed":"1e490c4ca6b43a9cf8637d695907888349f69bec"},{"fixed":"d8f2d46cbc9925e034a68aaaf60aad788d9373c1"}],"database_specific":{"cpe":"cpe:2.3:a:sqlite:sqlite:3.30.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.30.1"},{"last_affected":"3.30.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["3.30.1","version-3.30.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19959.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"104339471913397942939802911122431979945","length":3477},"id":"CVE-2019-19959-431abe6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1","target":{"file":"ext/misc/zipfile.c","function":"zipfileStep"}},{"deprecated":false,"digest":{"line_hashes":["71814066614843432280980704712041473121","216645858504996865357112267072969184675","239335266313309969182533178229610865249","311079271625203409937280754956246384681","121580900095085822418106151995070470985","164197602074587106059057669333140638102","129292076946546125971028062544365850448","327556687166518588200911711471829254530","313001803275392618590594638361048665402","128213423916597175769527743849561227405","60063495468950244746442318769766841350","158794796601896323848342222817397211861"],"threshold":0.9},"id":"CVE-2019-19959-59eebaea","signature_type":"Line","signature_version":"v1","source":"https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1","target":{"file":"ext/misc/zipfile.c"}},{"deprecated":false,"digest":{"function_hash":"59544577747646981207317814512786475191","length":3893},"id":"CVE-2019-19959-b8c3c9ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1","target":{"file":"ext/misc/zipfile.c","function":"zipfileUpdate"}}],"vanir_signatures_modified":"2026-08-07T14:52:59Z"}}],"references":[{"type":"ADVISORY","url":"https://github.com/sqlite/sqlite/commit/1e490c4ca6b43a9cf8637d695907888349f69bec"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20200204-0001/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4298-1/"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"FIX","url":"https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"19.10"},{"last_affected":"19.10"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}