BSD PortsSQLite < 3.50.3 -- CWE-190 Integer Overflow or Wraparound in FTS5 module
https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g reports: An integer overflow exists in the FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds. The FreeBSD build enables the FTS5 extension by default.
Affected versions
- sqlite3 >= 3.43.0,1 < 3.50.3,1
- linux-c7-sqlite >= 3.43.0 < 3.50.3
By system
1 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/sqlite3 | 3.53.4,1 | fixed | (299 days after) |
| OpenBSD | databases/sqlite3 | 3.53.2 | out of range, by version | |
| NetBSD | databases/sqlite3 | 3.53.4 | not listed | |
| MidnightBSD | databases/sqlite3 | 3.50.4_3,1 | out of range, by version | |
| DragonFly | databases/sqlite3 | 3.46.1_1,1 | vulnerable since 2025-10-29 | |
| FreeBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | fixed | |
| MidnightBSD | databases/linux-c7-sqlite3 | 3.7.17_2 | out of range, by version |