Astra Linux – Vulnerability in SQLite3

In SQLite version 3.31.1, the ALTER TABLE implementation contains a use-after-free issue, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement...

Astra Linux – Vulnerability in SQLite3

SQLite version 3.31.1 allows attackers to cause a denial of service segmentation fault through a malformed window-function query, due to improper handling of the initialization of the AggInfo object...

Astra Linux – Vulnerability in SQLite3

SQLite version 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c...

Astra Linux – Vulnerability in SQLite3

The zipfileUpdate function in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during the update of a ZIP archive...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.30.1, selectExpander in select.c continues with the WITH stack unwinding process even after a parsing error occurs...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.31.1, there is an out-of-bounds access issue involving the ALTER TABLE operation for views that contain nested FROM clauses...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.49.0 before 3.49.1, certain argument values passed to sqlite3dbconfig in the C-language API can cause a denial of service application crash. A sznBig multiplication is not cast to a 64-bit integer, which can lead to incorrect memory allocations...

Astra Linux – Vulnerability in SQLite3

In SQLite before version 3.32.3, select.c improperly handled the query-flattener optimization, resulting in a multiSelectOrderBy heap overflow due to the misuse of transitive properties for constant propagation...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.31.1, the isAuxiliaryVtabOperator function allows attackers to trigger a NULL pointer dereferencing and segmentation fault due to generated column optimizations...

Astra Linux – Vulnerability in SQLite3

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 through the idxGetTableInfo function, when a crafted SQL query is executed. NOTE: The vendor disputes the relevance of this report, as the sqlite3.exe user already has full privileges i.e., they are...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in SQLite in Google Chrome prior to version 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in SQLite3

The ext/fts3/fts3.c file in SQLite before version 3.32.0 contains a use-after-free in the fts3EvalNextRow function, which is related to the snippet feature...

Astra Linux – Vulnerability in PHP 7.3, PHP 8.1

In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, and 8.2. before 8.2.2, when using the PDO::quote function to quote user-supplied data for SQLite, providing an overly long string may cause the driver to incorrectly quote the data. This can further lead to SQL injection vulnerabilities...

Astra Linux – Vulnerability in SQLite3

Before version 3.32.0, SQLite allowed a virtual table to be renamed to the name of one of its shadow tables, which are related to alter.c and build.c...

Astra Linux – Vulnerability in SQLite

The osunix.c file in SQLite before version 3.13.0 improperly implements the temporary directory search algorithm. This may allow local users to obtain sensitive information, cause a denial of service application crash, or have unspecified other impacts by leveraging the current working directory...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.30.1, the exprListAppendList function in the window.c file allows attackers to trigger a invalid pointer dereferencing issue, as constant integer values in ORDER BY clauses of window definitions are handled incorrectly...

AlmaLinux 8 : nodejs:22 (ALSA-2026:54530)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54530 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

AlmaLinux 9 : nodejs:22 (ALSA-2026:55601)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55601 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

AlmaLinux 8 : nodejs:24 (ALSA-2026:54371)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54371 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

CVE-2026-72708: Improper Neutralization of Special Elements used in an SQL Command

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...