Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-35737: SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | lemon | 0:3.7.17-8.amzn2.1.2 |
| Amazon Linux · 2 | sqlite | 0:3.7.17-8.amzn2.1.2 |
| Amazon Linux · 2 | sqlite-debuginfo | 0:3.7.17-8.amzn2.1.2 |
| Amazon Linux · 2 | sqlite-devel | 0:3.7.17-8.amzn2.1.2 |
| Amazon Linux · 2 | sqlite-doc | 0:3.7.17-8.amzn2.1.2 |
| Amazon Linux · 2 | sqlite-tcl | 0:3.7.17-8.amzn2.1.2 |
Vulnerabilities 1
-
High 7.5
`libsqlite3-sys` via C SQLite improperly validates array index
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-35737.html