Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-119378: SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits. CVE-2026-119376: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process. CVE-2026-119375: SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | lemon | 0:3.7.17-8.amzn2.1.4 |
| Amazon Linux · 2 | sqlite | 0:3.7.17-8.amzn2.1.4 |
| Amazon Linux · 2 | sqlite-debuginfo | 0:3.7.17-8.amzn2.1.4 |
| Amazon Linux · 2 | sqlite-devel | 0:3.7.17-8.amzn2.1.4 |
| Amazon Linux · 2 | sqlite-doc | 0:3.7.17-8.amzn2.1.4 |
| Amazon Linux · 2 | sqlite-tcl | 0:3.7.17-8.amzn2.1.4 |
Vulnerabilities 3
-
Medium 5.5
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payloa…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted datab…
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wi…