BSD PortsSQLite -- integer overflow in key info allocation
[email protected] reports: An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
Affected versions
- sqlite3 >= 3.39.2,1 < 3.41.2,1
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/sqlite3 | 3.53.4,1 | fixed | (389 days after) |
| OpenBSD | databases/sqlite3 | 3.53.2 | out of range, by version | |
| NetBSD | databases/sqlite3 | 3.53.4 | not listed | |
| MidnightBSD | databases/sqlite3 | 3.50.4_3,1 | out of range, by version | |
| DragonFly | databases/sqlite3 | 3.46.1_1,1 | fixed |