CVE-2015-3415 in Apple iTunes

Summary

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Reservation

04/24/2015

Disclosure

04/24/2015

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
99027	Apple iTunes SQLite input validation	20	Not defined	Official fix	CVE-2015-3415
78123	Apple Watch SQLite input validation	20	Not defined	Official fix	CVE-2015-3415
75131	SQLite vdbe.c sqlite3VdbeExec input validation	20	Not defined	Official fix	CVE-2015-3415

Sources

• MITRE
• NVD
• CVE Details