[SECURITY] [DLA 1018-1] sqlite3 security update

2017-07-0908:06:24

lists.debian.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.009

Percentile

83.2%

JSON

Package : sqlite3
Version : 3.7.13-1+deb7u4
CVE ID : CVE-2017-10989
Debian Bug : #867618

It was discovered that there was a heap-based buffer over-read vulnerability in
SQLite, a lightweight database engine. The getNodeSize function in
ext/rtree/rtree.c mishandled undersized RTree blobs in a specially-crafted
database,

For Debian 7 "Wheezy", this issue has been fixed in sqlite3 version
3.7.13-1+deb7u4.

We recommend that you upgrade your sqlite3 packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb, Debian Project Leader
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian9mipslemon< 3.16.2-5+deb9u1lemon_3.16.2-5+deb9u1_mips.deb
Debian9mips64ellibsqlite3-0< 3.16.2-5+deb9u1libsqlite3-0_3.16.2-5+deb9u1_mips64el.deb
Debian9arm64libsqlite3-0< 3.16.2-5+deb9u1libsqlite3-0_3.16.2-5+deb9u1_arm64.deb
Debian9i386libsqlite3-0< 3.16.2-5+deb9u1libsqlite3-0_3.16.2-5+deb9u1_i386.deb
Debian7armellibsqlite3-0-dbg< 3.7.13-1+deb7u4libsqlite3-0-dbg_3.7.13-1+deb7u4_armel.deb
Debian9armhflemon< 3.16.2-5+deb9u1lemon_3.16.2-5+deb9u1_armhf.deb
Debian9arm64sqlite3< 3.16.2-5+deb9u1sqlite3_3.16.2-5+deb9u1_arm64.deb
Debian9mipssqlite3< 3.16.2-5+deb9u1sqlite3_3.16.2-5+deb9u1_mips.deb
Debian9mips64elsqlite3< 3.16.2-5+deb9u1sqlite3_3.16.2-5+deb9u1_mips64el.deb
Debian9arm64libsqlite3-0-dbg< 3.16.2-5+deb9u1libsqlite3-0-dbg_3.16.2-5+deb9u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips	lemon	< 3.16.2-5+deb9u1	lemon_3.16.2-5+deb9u1_mips.deb
Debian	9	mips64el	libsqlite3-0	< 3.16.2-5+deb9u1	libsqlite3-0_3.16.2-5+deb9u1_mips64el.deb
Debian	9	arm64	libsqlite3-0	< 3.16.2-5+deb9u1	libsqlite3-0_3.16.2-5+deb9u1_arm64.deb
Debian	9	i386	libsqlite3-0	< 3.16.2-5+deb9u1	libsqlite3-0_3.16.2-5+deb9u1_i386.deb
Debian	7	armel	libsqlite3-0-dbg	< 3.7.13-1+deb7u4	libsqlite3-0-dbg_3.7.13-1+deb7u4_armel.deb
Debian	9	armhf	lemon	< 3.16.2-5+deb9u1	lemon_3.16.2-5+deb9u1_armhf.deb
Debian	9	arm64	sqlite3	< 3.16.2-5+deb9u1	sqlite3_3.16.2-5+deb9u1_arm64.deb
Debian	9	mips	sqlite3	< 3.16.2-5+deb9u1	sqlite3_3.16.2-5+deb9u1_mips.deb
Debian	9	mips64el	sqlite3	< 3.16.2-5+deb9u1	sqlite3_3.16.2-5+deb9u1_mips64el.deb
Debian	9	arm64	libsqlite3-0-dbg	< 3.16.2-5+deb9u1	libsqlite3-0-dbg_3.16.2-5+deb9u1_arm64.deb