BSD PortsSQLite -- Integer Overflow vulnerability
· CVE-2025-52099 · VuXML entry
http://sqlite3.com reports: Integer Overflow vulnerability in SQLite SQLite3 v.3.50.0 allows a remote attacker to cause a denial of service via the setupLookaside function
Affected versions
- sqlite3 < 3.50.1,1
- linux_base-rl9-9.6 <= 9.6_1
- linux-c7-sqlite < 3.50.1
By system
2 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/sqlite3 | 3.53.4,1 | fixed | (300 days after) |
| OpenBSD | databases/sqlite3 | 3.53.2 | out of range, by version | |
| NetBSD | databases/sqlite3 | 3.53.4 | not listed | |
| MidnightBSD | databases/sqlite3 | 3.50.4_3,1 | out of range, by version | |
| DragonFly | databases/sqlite3 | 3.46.1_1,1 | vulnerable since 2025-10-28 | |
| FreeBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | vulnerable since 2025-10-28 | |
| MidnightBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | in range, by version |