[SECURITY] [DLA 1018-1] sqlite3 security update

2017-07-0908:06:24

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

83.0%

JSON

Package : sqlite3
Version : 3.7.13-1+deb7u4
CVE ID : CVE-2017-10989
Debian Bug : #867618

It was discovered that there was a heap-based buffer over-read vulnerability in
SQLite, a lightweight database engine. The getNodeSize function in
ext/rtree/rtree.c mishandled undersized RTree blobs in a specially-crafted
database,

For Debian 7 "Wheezy", this issue has been fixed in sqlite3 version
3.7.13-1+deb7u4.

We recommend that you upgrade your sqlite3 packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb, Debian Project Leader
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian9amd64lemon< 3.16.2-5+deb9u1lemon_3.16.2-5+deb9u1_amd64.deb
Debian8armellemon< 3.8.7.1-1+deb8u4lemon_3.8.7.1-1+deb8u4_armel.deb
Debian9mipsellibsqlite3-tcl< 3.16.2-5+deb9u1libsqlite3-tcl_3.16.2-5+deb9u1_mipsel.deb
Debian8armhflemon< 3.8.7.1-1+deb8u4lemon_3.8.7.1-1+deb8u4_armhf.deb
Debian9armhflibsqlite3-0-dbg< 3.16.2-5+deb9u1libsqlite3-0-dbg_3.16.2-5+deb9u1_armhf.deb
Debian7armhflemon< 3.7.13-1+deb7u4lemon_3.7.13-1+deb7u4_armhf.deb
Debian8armhflibsqlite3-tcl< 3.8.7.1-1+deb8u4libsqlite3-tcl_3.8.7.1-1+deb8u4_armhf.deb
Debian9armhflibsqlite3-0< 3.16.2-5+deb9u1libsqlite3-0_3.16.2-5+deb9u1_armhf.deb
Debian9mips64ellibsqlite3-0-dbg< 3.16.2-5+deb9u1libsqlite3-0-dbg_3.16.2-5+deb9u1_mips64el.deb
Debian8i386libsqlite3-0-dbg< 3.8.7.1-1+deb8u4libsqlite3-0-dbg_3.8.7.1-1+deb8u4_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	amd64	lemon	< 3.16.2-5+deb9u1	lemon_3.16.2-5+deb9u1_amd64.deb
Debian	8	armel	lemon	< 3.8.7.1-1+deb8u4	lemon_3.8.7.1-1+deb8u4_armel.deb
Debian	9	mipsel	libsqlite3-tcl	< 3.16.2-5+deb9u1	libsqlite3-tcl_3.16.2-5+deb9u1_mipsel.deb
Debian	8	armhf	lemon	< 3.8.7.1-1+deb8u4	lemon_3.8.7.1-1+deb8u4_armhf.deb
Debian	9	armhf	libsqlite3-0-dbg	< 3.16.2-5+deb9u1	libsqlite3-0-dbg_3.16.2-5+deb9u1_armhf.deb
Debian	7	armhf	lemon	< 3.7.13-1+deb7u4	lemon_3.7.13-1+deb7u4_armhf.deb
Debian	8	armhf	libsqlite3-tcl	< 3.8.7.1-1+deb8u4	libsqlite3-tcl_3.8.7.1-1+deb8u4_armhf.deb
Debian	9	armhf	libsqlite3-0	< 3.16.2-5+deb9u1	libsqlite3-0_3.16.2-5+deb9u1_armhf.deb
Debian	9	mips64el	libsqlite3-0-dbg	< 3.16.2-5+deb9u1	libsqlite3-0-dbg_3.16.2-5+deb9u1_mips64el.deb
Debian	8	i386	libsqlite3-0-dbg	< 3.8.7.1-1+deb8u4	libsqlite3-0-dbg_3.8.7.1-1+deb8u4_i386.deb