Description
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.25.3-1 | — |
| Debian 13 | sqlite3 | 3.25.3-1 | — |
| Debian 12 | sqlite3 | 3.25.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | sqlite3 | 3.22.0-1ubuntu0.1 | USN-4019-1 |
| Ubuntu 16.04 LTS | sqlite3 | 3.11.0-1ubuntu1.2 | USN-4019-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph | 18.2.1-1 | — |
Advisories 4
- ICSA-26-141-03 ABB B&R Automation Studio CISA ICS & IT advisories · May 21, 2026
- SA25P007 B&R Automation Studio Update of SQLite version ABB PSIRT · May 14, 2026
- USN-4019-1 sqlite3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- 4HZM000604 ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4) ABB PSIRT · Mar 26, 2026
References
- http://seclists.org/fulldisclosure/2019/Jan/62
- http://seclists.org/fulldisclosure/2019/Jan/64
- http://seclists.org/fulldisclosure/2019/Jan/66
- http://seclists.org/fulldisclosure/2019/Jan/67
- http://seclists.org/fulldisclosure/2019/Jan/68
- http://seclists.org/fulldisclosure/2019/Jan/69
- http://www.securityfocus.com/bid/106698
- https://seclists.org/bugtraq/2019/Jan/28
- https://seclists.org/bugtraq/2019/Jan/29
- https://seclists.org/bugtraq/2019/Jan/31
- https://seclists.org/bugtraq/2019/Jan/32
- https://seclists.org/bugtraq/2019/Jan/33
- https://seclists.org/bugtraq/2019/Jan/39
- https://support.apple.com/kb/HT209443
- https://support.apple.com/kb/HT209446
- https://support.apple.com/kb/HT209447
- https://support.apple.com/kb/HT209448
- https://support.apple.com/kb/HT209450
- https://support.apple.com/kb/HT209451
- https://sqlite.org/src/info/1a84668dcfdebaf12415d
- https://security.netapp.com/advisory/ntap-20190502-0004/
- USN-4019-1 vendor-advisory