Source: sqlite3 Version: 3.53.4-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for sqlite3. All should be fixed in the 3.54.0 upstream version, but please double-check! CVE-2026-119371[0]: | SQLite before 3.54.0 contains a stack exhaustion vulnerability that | allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit | because common table expressions are not counted against it. | Attackers can supply a WITH clause chaining tens of thousands of | CTEs, via plain SQL or a view in an untrusted database file, causing | unbounded selectExpander() recursion that crashes the process. CVE-2026-119372[1]: | SQLite before 3.54.0 built with FTS3/FTS4 and | SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free | vulnerability in fts3BestSnippet() caused by dangling cached | position-list pointers. Attackers can run a full-text MATCH query | combining OR and NEAR operators with snippet() to read freed heap | memory and crash the process. CVE-2026-119373[2]: | SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow | in fts5MergeRowidLists() that undersizes the output buffer when | merging detail=none prefix doclists. Attackers who can populate a | detail=none FTS5 table with negative rowids and run a prefix MATCH | query can write past the allocation, corrupting heap memory and | crashing the process. CVE-2026-119374[3]: | SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow | in fts5DoSecureDelete() that allows attackers to write past the leaf | page buffer via crafted footer key offsets. Attackers can supply a | database file with a corrupted FTS5 index that, when deleted from | with secure-delete enabled, corrupts heap memory and crashes the | application. CVE-2026-119375[4]: | SQLite before 3.54.0 contains an information disclosure | vulnerability that allows attackers to read uninitialized page-cache | memory by supplying a WAL file with an undersized page size. | Attackers can craft a database and WAL file whose oversized record | payload makes queries like substr() return stale bytes, disclosing | other table rows and internal pointers. CVE-2026-119376[5]: | SQLite before 3.54.0 contains a stack exhaustion vulnerability that | allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by | chaining COLLATE postfix operators. Attackers can supply roughly | 175,000 chained COLLATE operators in SQL or an untrusted database | view to trigger unbounded recursion in sqlite3WalkExprNN() and crash | the process. CVE-2026-119377[6]: | SQLite before 3.54.0 contains an authorization bypass vulnerability | in lookupName() that invokes the authorizer only for the first | joined table's USING column. Attackers able to submit SQL can query | a shared USING column in a RIGHT or FULL JOIN to read columns denied | via sqlite3_set_authorizer() SQLITE_READ restrictions. CVE-2026-119378[7]: | SQLite before 3.54.0 contains a use-after-free vulnerability in the | R-Tree extension that allows attackers to make applications use | freed heap memory by manipulating the %_node shadow table. Attackers | can supply a database declaring %_node WITHOUT ROWID or with a | RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the | process after node splits. CVE-2026-119379[8]: | SQLite before 3.54.0 built with the session extension contains a | heap buffer overflow vulnerability in sqlite3changeset_apply() that | allows attackers to corrupt heap memory by supplying crafted | changesets. Attackers can repeat a table name in a second changeset | block with a larger column count, causing sessionUpdateFind() to | memset past the undersized aUpdateMask allocation. CVE-2026-119586[9]: | SQLite command-line shell through 3.54.1 contains a command | injection vulnerability in the .recover command that emits attacker- | planted dot-commands stored in sqlite_schema.sql values verbatim. | Attackers can craft a database whose schema holds a valid CREATE | statement followed by a .shell or .system line, executing OS | commands when victims pipe .recover output into sqlite3. CVE-2026-119591[10]: | SQLite before 3.54.0 contains a stack exhaustion vulnerability in | countOfViewOptimization() that allows attackers to crash the host | process via count(*) over a large multi-row VALUES clause. Attackers | supplying SQL or a database file with a crafted view can trigger | deeply nested TK_PLUS expressions whose recursive freeing in | sqlite3ExprDeleteNN() exhausts the C stack, causing denial of | service. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-119371 https://www.cve.org/CVERecord?id=CVE-2026-119371 [1] https://security-tracker.debian.org/tracker/CVE-2026-119372 https://www.cve.org/CVERecord?id=CVE-2026-119372 [2] https://security-tracker.debian.org/tracker/CVE-2026-119373 https://www.cve.org/CVERecord?id=CVE-2026-119373 [3] https://security-tracker.debian.org/tracker/CVE-2026-119374 https://www.cve.org/CVERecord?id=CVE-2026-119374 [4] https://security-tracker.debian.org/tracker/CVE-2026-119375 https://www.cve.org/CVERecord?id=CVE-2026-119375 [5] https://security-tracker.debian.org/tracker/CVE-2026-119376 https://www.cve.org/CVERecord?id=CVE-2026-119376 [6] https://security-tracker.debian.org/tracker/CVE-2026-119377 https://www.cve.org/CVERecord?id=CVE-2026-119377 [7] https://security-tracker.debian.org/tracker/CVE-2026-119378 https://www.cve.org/CVERecord?id=CVE-2026-119378 [8] https://security-tracker.debian.org/tracker/CVE-2026-119379 https://www.cve.org/CVERecord?id=CVE-2026-119379 [9] https://security-tracker.debian.org/tracker/CVE-2026-119586 https://www.cve.org/CVERecord?id=CVE-2026-119586 [10] https://security-tracker.debian.org/tracker/CVE-2026-119591 https://www.cve.org/CVERecord?id=CVE-2026-119591 Regards, Salvatore
