Description
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SQLite | SQLite3 | 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 3.23, 3.24, 3.25, 3.26, 3.27, 3.28, 3.29, 3.30, 3.31, 3.32, 3.33, 3.34, 3.35, 3.36, 3.37, 3.38, 3.39, 3.40, 3.41, 3.42, 3.43 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.43.1-1 | — |
| Debian 13 | sqlite3 | 3.43.1-1 | — |
| Debian 12 | sqlite3 | 3.40.1-2+deb12u1 | — |
| Debian 11 | sqlite3 | 3.34.1-3+deb11u1 | DLA-3907-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | sqlite3 | 3.37.2-2ubuntu0.3 | USN-6566-1 |
| Ubuntu 20.04 LTS | sqlite3 | 3.31.1-4ubuntu0.6 | USN-6566-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | sqlite3 | 3.22.0-1ubuntu0.7+esm1 | USN-6566-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | sqlite +2 | 3.34.1-7.el9_3 | RHSA-2024:0465 |
| RHEL 8 | lemon +4 | 3.26.0-19.el8_9 | RHSA-2024:0253 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | sqlite +2 | 3.34.1-6.el9_2.1 | RHSA-2024:1081 |
| RHEL 8.8 EUS | lemon +4 | 3.26.0-18.el8_8.1 | RHSA-2024:0589 |
| RHEL 8.6 EUS | lemon +4 | 3.26.0-16.el8_6.2 | RHSA-2024:1107 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | sqlite +2 | 3.34.1-7.el9_3 | ALSA-2024:0465 |
| AlmaLinux 8 | lemon +4 | 3.26.0-19.el8_9 | ALSA-2024:0253 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | sqlite | 3.34.1-7.el9_3 | RLSA-2024:0465 |
| Rocky Linux 8 | sqlite | 3.26.0-19.el8_9 | RLSA-2024:0253 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | qt6-qtwebengine | 6.6.3-r1 | — |
| Alpine v3.23 | qt5-qtwebengine | 5.15.16-r7 | — |
| Alpine v3.23 | qt6-qtwebengine | 6.6.3-r1 | — |
| Alpine v3.22 | qt5-qtwebengine | 5.15.16-r7 | — |
| Alpine v3.22 | qt6-qtwebengine | 6.6.3-r1 | — |
| Alpine v3.21 | qt5-qtwebengine | 5.15.16-r7 | — |
| Alpine v3.21 | qt6-qtwebengine | 6.6.3-r1 | — |
| Alpine v3.20 | qt5-qtwebengine | 5.15.16-r7 | — |
| Alpine v3.20 | qt6-qtwebengine | 6.6.3-r1 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | qt5-qtwebengine | 5.15.16-r5 | — |
| Alpine v3.19 | qt6-qtwebengine | 6.6.1-r9 | — |
| Alpine v3.18 | sqlite | 3.41.2-r3 | — |
| Alpine v3.17 | sqlite | 3.40.1-r1 | — |
| Alpine v3.16 | sqlite | 3.40.1-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | lemon +7 | 3.40.0-1.amzn2023.0.4 | ALAS2023-2024-490 |
| Amazon Linux 2023 | nspr +1 | 4.35.0-5.amzn2023.0.5 | ALAS2023-2024-507 |
| Amazon Linux 2023 | nss +10 | 3.90.0-3.amzn2023.0.5 | ALAS2023-2024-507 |
| Amazon Linux 2023 | polkit +3 | 0.117-11.amzn2023.0.1 | ALAS2023-2024-508 |
| Amazon Linux 2 | nss +4 | 3.90.0-2.amzn2.0.2 | ALAS2-2024-2442 |
| Amazon Linux 2 | thunderbird | 115.6.0-1.amzn2.0.2 | ALAS2-2024-2417 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | sqlite | 3.39.2-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | sqlite +2 | 3.34.1-7.el9_3 | ELSA-2024-0465 |
| Oracle Linux 8 | lemon +4 | 3.26.0-19.0.1.el8_9 | ELSA-2024-0253 |
Advisories 39
- ALSA-2024:0465 Moderate: sqlite security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0253 Moderate: sqlite security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:1107 Red Hat Security Advisory: sqlite security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:1081 Red Hat Security Advisory: sqlite security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0589 Red Hat Security Advisory: sqlite security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0465 Red Hat Security Advisory: sqlite security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0253 Red Hat Security Advisory: sqlite security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-794697 SSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1 Siemens ProductCERT · Oct 13, 2026
- ICSA-26-141-03 ABB B&R Automation Studio CISA ICS & IT advisories · May 21, 2026
- SA25P007 B&R Automation Studio Update of SQLite version ABB PSIRT · May 14, 2026
- USN-6566-1 sqlite3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-6566-2 sqlite3 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- 4HZM000604 ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4) ABB PSIRT · Mar 26, 2026
- DLA-3907-1 sqlite3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:0253 Moderate: sqlite security update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2024-0092 Red Hat SQLite: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jan 27, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- RLSA-2024:0465 Moderate: sqlite security update Rocky Linux Security Advisories · Oct 7, 2025
- VDE-2024-073 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- ICSA-25-100-02 Siemens SIDIS Prime CISA ICS & IT advisories · May 6, 2025
- ICSA-24-319-01 Siemens RUGGEDCOM CROSSBOW CISA ICS & IT advisories · May 6, 2025
- SCA-2025-0006 Vulnerability affecting picoScan and multiScan SICK PSIRT · Apr 28, 2025
- NCSC-2025-0106 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Apr 8, 2025
- SSA-277137 SSA-277137: Multiple Vulnerabilities in SIDIS Prime Before V4.0.700 Siemens ProductCERT · Apr 8, 2025
- WID-SEC-2024-1307 Red Hat OpenShift Service Mesh Containers: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 5, 2025
- WID-SEC-2024-0521 IBM MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2024
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- SSA-000297 SSA-000297: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Before V5.6 Siemens ProductCERT · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- NCSC-2024-0419 Kwetsbaarheden verholpen in Oracle Java NCSC-NL (Netherlands) · Oct 17, 2024
- ICSA-23-166-11 Siemens SIMATIC S7-1500 TM MFP Linux Kernel CISA ICS & IT advisories · Apr 9, 2024
- ALAS2023-2024-507 Important: nss security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 6, 2024
- ALAS2023-2024-508 Important: polkit security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 6, 2024
- ALAS2-2024-2442 Important: nss security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 1, 2024
- ELSA-2024-0465 Moderate: sqlite security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 25, 2024
- ALAS2023-2024-490 Important: sqlite security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 22, 2024
- ALAS2-2024-2417 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 22, 2024
- ELSA-2024-0253 Moderate: sqlite security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 16, 2024
References
- https://vuldb.com/?id.248999 vdb-entry technical-description
- https://vuldb.com/?ctiid.248999 signature permissions-required
- https://sqlite.org/forum/forumpost/5bcbf4571c related
- https://sqlite.org/src/info/0e4e7a05c4204b47 patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/
- https://security.netapp.com/advisory/ntap-20240112-0008/