vulnwire
5.9med

CVE-2016-6153

os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain s…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 41%
Public exploits
0
none known

os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.

Exploit prediction (EPSS)

0.48% probability of exploitation in the next 30 days, higher than 41% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.9CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • tenable.com /security/tns-2016-20 · x_transferred
  • lists.opensuse.org /opensuse-updates/2016-08/msg00053.html · vendor-advisory, x_transferred
  • sqlite.org /releaselog/3_13_0.html · x_transferred
  • openwall.com /lists/oss-security/2016/07/01/2 · mailing-list, x_transferred
  • securityfocus.com /bid/91546 · vdb-entry, x_transferred
  • sqlite.org /cgi/src/info/67985761aa93fb61 · x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/IGQTH7V45QVHFDXJAEECHEO3 · vendor-advisory, x_transferred
  • korelogic.com /Resources/Advisories/KL-001-2016-003.txt · x_transferred
  • openwall.com /lists/oss-security/2016/07/01/1 · mailing-list, x_transferred
  • usn.ubuntu.com /4019-1/ · vendor-advisory, x_transferred
  • usn.ubuntu.com /4019-2/ · vendor-advisory, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLE · vendor-advisory, x_transferred
  • lists.debian.org /debian-lts-announce/2023/05/msg00022.html · mailing-list, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.