BSD Portssqlite -- Integer Truncation on SQLite
[email protected] reports: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue.
Affected versions
- sqlite3 < 3.50.2,1
- linux-c7-sqlite < 3.50.2
- linux_base-rl9 >= 9.5.14 < 9.6_1
- linux-rl9-sqlite3 >= 0
By system
2 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/sqlite3 | 3.53.4,1 | fixed | (397 days after) |
| OpenBSD | databases/sqlite3 | 3.53.2 | out of range, by version | |
| NetBSD | databases/sqlite3 | 3.53.4 | not listed | |
| MidnightBSD | databases/sqlite3 | 3.50.4_3,1 | out of range, by version | |
| DragonFly | databases/sqlite3 | 3.46.1_1,1 | vulnerable since 2025-07-23 | |
| FreeBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | vulnerable since 2025-07-23 | |
| MidnightBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | in range, by version | |
| FreeBSD | emulators/linux_base-rl9 | 9.8_1 | fixed | |
| MidnightBSD | emulators/linux_base-rl9 | ${LINUX_DIST_VER}_4 | out of range, by version |