Summary
It was discovered that SQLite incorrectly handled certain memory operations
in the FTS5 full-text search extension. An attacker could use this issue to
cause SQLite to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | sqlite3 | 3.45.1-1ubuntu2.6 |
| Ubuntu · 25.10 | sqlite3 | 3.46.1-8ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | sqlite3 | 3.46.1-9ubuntu0.1 |
Vulnerabilities 2
-
High 7.8
SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifyi…
-
Medium 5.5
SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek
SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in …