BSD Portssqlite -- integer overflow
[email protected] reports: An integer overflow can be triggered in SQLites `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
Affected versions
- sqlite3 < 3.49.1,1
- linux-c7-sqlite < 3.49.1
- linux_base-rl9 < 3.49.1
By system
2 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/sqlite3 | 3.53.4,1 | fixed | (387 days after) |
| OpenBSD | databases/sqlite3 | 3.53.2 | out of range, by version | |
| NetBSD | databases/sqlite3 | 3.53.4 | not listed | |
| MidnightBSD | databases/sqlite3 | 3.50.4_3,1 | out of range, by version | |
| DragonFly | databases/sqlite3 | 3.46.1_1,1 | vulnerable since 2025-08-02 | |
| FreeBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | vulnerable since 2025-08-02 | |
| MidnightBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | in range, by version | |
| FreeBSD | emulators/linux_base-rl9 | 9.8_1 | fixed | |
| MidnightBSD | emulators/linux_base-rl9 | ${LINUX_DIST_VER}_4 | in range, by version |