Description
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.36.0-2 | — |
| Debian 13 | sqlite3 | 3.36.0-2 | — |
| Debian 12 | sqlite3 | 3.36.0-2 | — |
| Debian 11 | sqlite3 | 3.34.1-3+deb11u1 | DLA-3907-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | sqlite3 | 3.31.1-4ubuntu0.3 | USN-5403-1 |
| Ubuntu 18.04 LTS | sqlite3 | 3.22.0-1ubuntu0.5 | USN-5403-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-1 |
| SLES 15 SP3 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-1 |
| SLES 15 SP2 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLES 15 SP1 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLES 15 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SLES 12 SP4 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SLES 12 SP3 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SLES 12 SP2 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SLES for SAP 15 SP2 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLES for SAP 15 SP1 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLES for SAP 15 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLES for SAP 12 SP5 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SLES for SAP 12 SP4 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SLE Micro 5.3 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLE Micro 5.2 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-1 |
| SLE Micro 5.1 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-1 |
| SLE HPC 15 SP2 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLE HPC 15 SP1 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SLE HPC 15 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SUSE OpenStack Cloud Crowbar 9 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SUSE OpenStack Cloud 9 | sqlite3 | 3.39.3-9.23.1 | SUSE-SU-2022:3401-1 |
| SUSE Manager Server 4.1 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SUSE Manager Retail Branch Server 4.1 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SUSE Manager Proxy 4.1 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SUSE Enterprise Storage 7 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
| SUSE Enterprise Storage 6 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sqlite3 | 3.39.3-2.1 | openSUSE-SU-2024:12347-1 |
| openSUSE Leap 15.4 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-1 |
| openSUSE Leap 15.3 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.2 | sqlite3 | 3.39.3-150000.3.17.1 | SUSE-SU-2022:3307-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | sqlite | 3.36.0-3 | — |
Advisories 12
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2022-1846 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-5403-1 sqlite3 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-3907-1 sqlite3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:3401-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12347-1 libsqlite3-0-3.39.3-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3307-2 Security update for sqlite3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3307-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- SCA-2025-0006 Vulnerability affecting picoScan and multiScan SICK PSIRT · Apr 28, 2025
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
References
- https://www.sqlite.org/forum/forumpost/718c0a8d17
- https://support.apple.com/kb/HT213446
- https://support.apple.com/kb/HT213488
- https://support.apple.com/kb/HT213486
- https://support.apple.com/kb/HT213487
- 20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13 mailing-list
- 20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13 mailing-list
- 20221030 APPLE-SA-2022-10-27-3 Additional information for APPLE-SA-2022-09-12-1 iOS 16 mailing-list
- 20221030 APPLE-SA-2022-10-27-13 watchOS 9 mailing-list
- 20221030 APPLE-SA-2022-10-27-11 tvOS 16 mailing-list