Source: sqlite3 Version: 3.8.7.1-1 Severity: important Tags: patch security upstream
Hi, the following vulnerability was published for sqlite3. CVE-2018-8740[0]: | In SQLite through 3.22.0, databases whose schema is corrupted using a | CREATE TABLE AS statement could cause a NULL pointer dereference, | related to build.c and prepare.c. The fix can be verified with the rerpording db from the launchpad bugreport, [2] including showing that the issue is in the library and not in the shell with a minimal example. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2018-8740 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8740 [1] http://www.openwall.com/lists/oss-security/2018/03/17/1 [2] https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1756349 [3] https://www.sqlite.org/cgi/src/timeline?r=corrupt-schema [4] https://www.sqlite.org/cgi/src/vdiff?from=1774f1c3baf0bc3d&to=d75e67654aa9620b [5] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6964 (not yet accessible) Regards, Salvatore
