Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.05904.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Google Chrome affected
Version Status Constraints
unspecified affected < 79.0.3945.79

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

Configuration 6 [-]

cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

Configuration 7 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 8 [-]

cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Ansible Tower 3.4 for RHEL 7
ansible-tower-34/ansible-tower-memcached:1.4.15-28 cpe:/a:redhat:ansible_tower:3.4::el7 RHBA-2020:0547 2020-02-18T00:00:00Z
ansible-tower-35/ansible-tower-memcached:1.4.15-28 cpe:/a:redhat:ansible_tower:3.4::el7 RHBA-2020:0547 2020-02-18T00:00:00Z
ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28 cpe:/a:redhat:ansible_tower:3.4::el7 RHBA-2020:0547 2020-02-18T00:00:00Z
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:79.0.3945.79-1.el6_10 cpe:/a:redhat:rhel_extras:6 RHSA-2019:4238 2019-12-16T00:00:00Z
Red Hat Enterprise Linux 7
sqlite-0:3.7.17-8.el7_7.1 cpe:/o:redhat:enterprise_linux:7 RHSA-2020:0227 2020-01-27T00:00:00Z
Red Hat Enterprise Linux 7.6 Extended Update Support
sqlite-0:3.7.17-8.el7_6.1 cpe:/o:redhat:rhel_eus:7.6 RHSA-2020:2014 2020-05-05T00:00:00Z
Red Hat Enterprise Linux 8
sqlite-0:3.26.0-4.el8_1 cpe:/a:redhat:enterprise_linux:8 RHSA-2020:0273 2020-01-29T00:00:00Z
sqlite-0:3.26.0-4.el8_1 cpe:/o:redhat:enterprise_linux:8 RHSA-2020:0273 2020-01-29T00:00:00Z
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions
sqlite-0:3.26.0-4.el8_0 cpe:/a:redhat:rhel_e4s:8.0 RHSA-2020:0229 2020-01-27T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Canonical Subscribe
Ubuntu Linux Subscribe
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Google Subscribe
Chrome Subscribe
Opensuse Subscribe
Backports Sle Subscribe
Oracle Subscribe
Communications Cloud Native Core Network Repository Function Subscribe
Redhat Subscribe
Ansible Tower Subscribe
Enterprise Linux Subscribe
Enterprise Linux Desktop Subscribe
Enterprise Linux Eus Subscribe
Enterprise Linux Server Subscribe
Enterprise Linux Server Aus Subscribe
Enterprise Linux Server Tus Subscribe
Enterprise Linux Workstation Subscribe
Openshift Container Platform Subscribe
Rhel E4s Subscribe
Rhel Eus Subscribe
Rhel Extras Subscribe
Suse Subscribe
Linux Enterprise Subscribe
Package Hub Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-4606-1 chromium security update
EUVD EUVD EUVD-2019-5151 Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Ubuntu USN Ubuntu USN USN-4298-1 SQLite vulnerabilities
Ubuntu USN Ubuntu USN USN-4298-2 SQLite vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:4238 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0227 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0229 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0273 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0451 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0463 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0476 cve-icon cve-icon
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html cve-icon cve-icon cve-icon
https://crbug.com/1025466 cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N5CIQCVS6E3ULJCNU7YJXJPO2BLQZDTK/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-13734 cve-icon
https://seclists.org/bugtraq/2020/Jan/27 cve-icon cve-icon
https://security.gentoo.org/glsa/202003-08 cve-icon cve-icon
https://usn.ubuntu.com/4298-1/ cve-icon cve-icon
https://usn.ubuntu.com/4298-2/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-13734 cve-icon
https://www.debian.org/security/2020/dsa-4606 cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2024-08-05T00:05:43.986Z

Reserved: 2019-07-18T00:00:00

Link: CVE-2019-13734

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-12-10T22:15:13.260

Modified: 2024-11-21T04:25:36.193

Link: CVE-2019-13734

cve-icon Redhat

Severity : Important

Publid Date: 2019-12-10T00:00:00Z

Links: CVE-2019-13734 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses