Summary
It was discovered that SQLite incorrectly handled certain protection
mechanisms when using a CLI script with the --safe option, contrary to
expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)
It was discovered that SQLite incorrectly handled certain memory operations
in the sessions extension. A remote attacker could possibly use this issue
to cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | sqlite3 | 3.31.1-4ubuntu0.6 |
| Ubuntu · 22.04 LTS 22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.3 |
Vulnerabilities 2
-
High 7.3
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the…
-
Medium 5.5
SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer …