CVE-2019-16168: canonical ubuntu_linux Divide By Zero
Modified
AliasesALPINE-CVE-2019-16168SUSE-SU-2019:2533-1SUSE-SU-2019:2536-1UBUNTU-CVE-2019-16168DEBIAN-CVE-2019-16168openSUSE-SU-2019:2298-1openSUSE-SU-2019:2300-1CGA-2xq3-p82w-9c7vCGA-3j7c-wcp4-83j4CGA-7h58-5wp8-m5w7CGA-7xf4-926q-rqfcCGA-98vh-jcff-8qwjCGA-c24r-47hm-h738CGA-cc9x-g7vf-gjmjCGA-cmqv-426f-hwvvCGA-fxcw-2vrw-q429CGA-hw9w-5v86-964wCGA-v5p2-xj2f-mmx8CGA-wp7h-29g9-w2wc
Published 09-09-2019Last modified 14-10-2026
Vulnerability summary
CVE-2019-16168 is a medium (CVSS 6.5) Divide By Zero vulnerability in canonical ubuntu_linux. EPSS estimates a 4.22% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
4.22%
0%100%
Low · -0.03 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 09-09-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
CVSS metrics
7 scores · 6 sources · 2 versionsMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 6 agree
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.22%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
Decrease -0.03 pp
From 4.25% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp7 products
- active_iq_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)
- e-series_santricity_os_controller≥ 11.0.0, ≤ 11.60.3
- oncommand_insightna
- oncommand_workflow_automationna
- ontap_select_deploy_administration_utilityna
Oracle7 products
- communications_design_studio7.3.4.3.0 | 7.3.5.5.0 | 7.4.0.4.0
- jdk1.8.0:update231
- jre1.8.0:update231
- mysql≥ 8.0.0, ≤ 8.0.18
- outside_in_technology8.5.4
Chainguard6 products
- mysql-8.0< 8.0.38-r0
- mysql-8.0-client< 8.0.38-r0
- mysql-8.0-dev< 8.0.38-r0
- mysql-8.0-iamguarded-compat< 8.0.38-r0
- mysql-8.0-oci-entrypoint< 8.0.38-r0
Suse6 products
- sqlite3&distro=SUSE Linux Enterprise Desktop 12 SP4< 3.8.10.2-9.12.1
- sqlite3&distro=SUSE Linux Enterprise Module for Basesystem 15< 3.28.0-3.9.2
- sqlite3&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 3.28.0-3.9.2
- sqlite3&distro=SUSE Linux Enterprise Server 12 SP4< 3.8.10.2-9.12.1
- sqlite3&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 3.8.10.2-9.12.1
Debian2 products
- sqlite3< 3.29.0-2
- debian_linuxEOL9.0
Opensuse2 products
- sqlite3&distro=openSUSE Leap 15.0< 3.28.0-lp150.2.9.1
- sqlite3&distro=openSUSE Leap 15.1< 3.28.0-lp151.2.3.1
Alpine1 product
- sqlite≥ 3.8.5, < 3.28.0-r1 | ≥ 3.8.5, < 3.25.3-r2
Canonical1 product
- ubuntu_linuxEOL12.04 | 16.04 | 18.04 | 19.04 | 19.10
Fedoraproject1 product
- fedoraEOL30
Mcafee1 product
- policy_auditor< 6.5.1
Sqlite1 product
- sqlite≥ 3.8.5, ≤ 3.29.0
Tenable1 product
- nessus_agent≤ 8.2.3
Ubuntu1 product
- sqlite3< 3.11.0-1ubuntu1.3 | < 3.22.0-1ubuntu0.2
13 vendors · 37 products
References
31 links- www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62X Refsource MISCVendor AdvisoryAdvisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.htmlVendor AdvisoryX Refsource SUSEBroken LinkWEB
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.htmlVendor AdvisoryX Refsource SUSEBroken LinkWEB
Show all 31 references
lists.debian.org/debian-lts-announce/2020/08/msg00037.htmlMailing ListX Refsource MLISTThird Party AdvisoryAdvisory- kc.mcafee.com/corporate/index?page=content&id=SB10365X Refsource CONFIRMThird Party AdvisoryAdvisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
