[SECURITY] [DLA 2203-1] sqlite3 security update

2020-05-0520:32:48

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.016 Low

EPSS

Percentile

87.4%

JSON

Package : sqlite3
Version : 3.8.7.1-1+deb8u5
CVE ID : CVE-2020-11655

It was discovered that there was a denial of service attack in the
SQLite database, often embedded into other programs and servers.

In the event of a semantic error in an aggregate query, SQLite did
not return early from the "resetAccumulator()" function which would
lead to a crash via a segmentation fault.

For Debian 8 "Jessie", this issue has been fixed in sqlite3 version
3.8.7.1-1+deb8u5.

We recommend that you upgrade your sqlite3 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian9amd64sqlite3< 3.16.2-5+deb9u2sqlite3_3.16.2-5+deb9u2_amd64.deb
Debian8armelsqlite3< 3.8.7.1-1+deb8u5sqlite3_3.8.7.1-1+deb8u5_armel.deb
Debian9armellemon< 3.16.2-5+deb9u2lemon_3.16.2-5+deb9u2_armel.deb
Debian9i386libsqlite3-dev< 3.16.2-5+deb9u2libsqlite3-dev_3.16.2-5+deb9u2_i386.deb
Debian8amd64libsqlite3-0< 3.8.7.1-1+deb8u5libsqlite3-0_3.8.7.1-1+deb8u5_amd64.deb
Debian9i386libsqlite3-0-dbg< 3.16.2-5+deb9u2libsqlite3-0-dbg_3.16.2-5+deb9u2_i386.deb
Debian8amd64libsqlite3-0-dbg< 3.8.7.1-1+deb8u5libsqlite3-0-dbg_3.8.7.1-1+deb8u5_amd64.deb
Debian9armhfsqlite3< 3.16.2-5+deb9u2sqlite3_3.16.2-5+deb9u2_armhf.deb
Debian9armhflibsqlite3-dev< 3.16.2-5+deb9u2libsqlite3-dev_3.16.2-5+deb9u2_armhf.deb
Debian8i386libsqlite3-0-dbg< 3.8.7.1-1+deb8u5libsqlite3-0-dbg_3.8.7.1-1+deb8u5_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	amd64	sqlite3	< 3.16.2-5+deb9u2	sqlite3_3.16.2-5+deb9u2_amd64.deb
Debian	8	armel	sqlite3	< 3.8.7.1-1+deb8u5	sqlite3_3.8.7.1-1+deb8u5_armel.deb
Debian	9	armel	lemon	< 3.16.2-5+deb9u2	lemon_3.16.2-5+deb9u2_armel.deb
Debian	9	i386	libsqlite3-dev	< 3.16.2-5+deb9u2	libsqlite3-dev_3.16.2-5+deb9u2_i386.deb
Debian	8	amd64	libsqlite3-0	< 3.8.7.1-1+deb8u5	libsqlite3-0_3.8.7.1-1+deb8u5_amd64.deb
Debian	9	i386	libsqlite3-0-dbg	< 3.16.2-5+deb9u2	libsqlite3-0-dbg_3.16.2-5+deb9u2_i386.deb
Debian	8	amd64	libsqlite3-0-dbg	< 3.8.7.1-1+deb8u5	libsqlite3-0-dbg_3.8.7.1-1+deb8u5_amd64.deb
Debian	9	armhf	sqlite3	< 3.16.2-5+deb9u2	sqlite3_3.16.2-5+deb9u2_armhf.deb
Debian	9	armhf	libsqlite3-dev	< 3.16.2-5+deb9u2	libsqlite3-dev_3.16.2-5+deb9u2_armhf.deb
Debian	8	i386	libsqlite3-0-dbg	< 3.8.7.1-1+deb8u5	libsqlite3-0-dbg_3.8.7.1-1+deb8u5_i386.deb