Summary
It was discovered that SQLite incorrectly handled aggregate terms. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2025-6965)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This update fixes the issue in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. This issue was previously fixed in Ubuntu 20.04 LTS via
USN-7528-1. (CVE-2025-29088)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | sqlite3 | 3.8.2-1ubuntu2.2+esm5 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | sqlite3 | 3.11.0-1ubuntu1.5+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | sqlite3 | 3.22.0-1ubuntu0.7+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | sqlite3 | 3.31.1-4ubuntu0.7+esm1 |
Vulnerabilities 2
-
High 7.2
Integer Truncation on SQLite
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
-
Medium 5.6
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial…