Description
SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation because any user can replace a /tmp/sqliteodbc$$ file with new contents that cause loading of an arbitrary library.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqliteodbc | No fix yet | — |
| Debian 13 | sqliteodbc | No fix yet | — |
| Debian 12 | sqliteodbc | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sqliteodbc | No fix yet | — |
| Ubuntu 26.04 LTS | sqliteodbc | No fix yet | — |
| Ubuntu 25.10 | sqliteodbc | No fix yet | — |
| Ubuntu 24.04 LTS | sqliteodbc | No fix yet | — |
| Ubuntu 22.04 LTS | sqliteodbc | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | sqliteodbc | No fix yet | — |
| Ubuntu 18.04 LTS | sqliteodbc | No fix yet | — |
| Ubuntu 16.04 LTS | sqliteodbc | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | sqliteodbc | 0.9996-bp151.4.3.1 | openSUSE-SU-2020:0612-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sqliteodbc | 0.9998-1.7 | openSUSE-SU-2024:11401-1 |
| openSUSE Leap 15.1 | sqliteodbc | 0.9996-lp151.3.3.1 | openSUSE-SU-2020:0628-1 |
Advisories 3
- openSUSE-SU-2024:11401-1 sqliteodbc-0.9998-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0628-1 Security update for sqliteodbc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0612-1 Security update for sqliteodbc SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://sysdream.com/news/lab/
- http://www.ch-werner.de/sqliteodbc/
- FEDORA-2020-1e85425a52 vendor-advisory
- FEDORA-2020-c98c7da2f6 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1825762
- FEDORA-2020-df7c647fa3 vendor-advisory
- openSUSE-SU-2020:0612 vendor-advisory
- openSUSE-SU-2020:0628 vendor-advisory
- https://sysdream.com/news/lab/2020-05-25-cve-2020-12050-fedora-red-hat-centos-local-privilege-escalation-through-a-race-condition-in-the-sqliteodbc-installer-script/