Univention Bugzilla – Bug 52105
(ES 4.3) sqlite3
Last modified: 2020-11-30 18:15:57 CET
Provide sqlite3 version 3.16.2-5+deb9u2 for UCS 4.3 First imported at bug #51900 This update addresses the following issues: * NULL pointer dereference with databases with schema corrupted with CREATE TABLE AS allows for denial of service (CVE-2018-8740) * Multiple flaws in sqlite which can be triggered via corrupted internal databases (Magellan) (CVE-2018-20346) * Multiple flaws in sqlite which can be triggered via corrupted internal databases (Magellan) (CVE-2018-20506) * Out-of-bounds access in SQLite (CVE-2019-5827) * Heap-based buffer over-read in function fts5HashEntrySort in sqlite3.c (CVE-2019-9936) * NULL pointer dereference in function fts5ChunkIterate in sqlite3.c (CVE-2019-9937) * Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168) * selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error (CVE-2019-20218) * Malformed window-function query leads to DoS (CVE-2020-11655) * Integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434) * Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630) * NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query (CVE-2020-13632) * Use-after-free in resetAccumulator in select.c (CVE-2020-13871)
sqlite3: Installiert: 3.16.2-5+deb9u2 Installationskandidat: 3.16.2-5+deb9u2 Versionstabelle: *** 3.16.2-5+deb9u2 500 500 http://192.168.0.10/build2 ucs_4.3-0-extsec4.3/amd64/ Packages
CLOSED: Released as extsec4.3 update