DBD-SQLite 1.59_02 Deleted
Security Advisories
CVE-2020-15358
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
- https://www.sqlite.org/src/info/10fa79d00f8091e5
- https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2
- https://www.sqlite.org/src/tktview?name=8f157e8010
- https://security.netapp.com/advisory/ntap-20200709-0001/
- https://security.gentoo.org/glsa/202007-26
- https://usn.ubuntu.com/4438-1/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://support.apple.com/kb/HT211931
- https://support.apple.com/kb/HT211844
- https://support.apple.com/kb/HT211850
- https://support.apple.com/kb/HT211843
- https://support.apple.com/kb/HT211847
- http://seclists.org/fulldisclosure/2020/Nov/19
- http://seclists.org/fulldisclosure/2020/Nov/22
- http://seclists.org/fulldisclosure/2020/Nov/20
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://support.apple.com/kb/HT212147
- http://seclists.org/fulldisclosure/2021/Feb/14
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://www.oracle.com/security-alerts/cpuapr2022.html
Fixed version: >=1.65_03
Severity: medium
Reported: 2020-06-27
CVE-2020-13632
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
- https://bugs.chromium.org/p/chromium/issues/detail?id=1080459
- https://sqlite.org/src/info/a4dd148928ea65bd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/
- https://security.netapp.com/advisory/ntap-20200608-0002/
- https://usn.ubuntu.com/4394-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-26
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: medium
Reported: 2020-05-27
CVE-2020-13631
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
- https://bugs.chromium.org/p/chromium/issues/detail?id=1080459
- https://sqlite.org/src/info/eca0ba2cf4c0fdf7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/
- https://security.netapp.com/advisory/ntap-20200608-0002/
- https://usn.ubuntu.com/4394-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-26
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://support.apple.com/kb/HT211931
- https://support.apple.com/kb/HT211844
- https://support.apple.com/kb/HT211850
- https://support.apple.com/kb/HT211843
- https://support.apple.com/kb/HT211952
- http://seclists.org/fulldisclosure/2020/Nov/19
- http://seclists.org/fulldisclosure/2020/Nov/22
- http://seclists.org/fulldisclosure/2020/Nov/20
- https://support.apple.com/kb/HT211935
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: medium
Reported: 2020-05-27
CVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
- https://bugs.chromium.org/p/chromium/issues/detail?id=1080459
- https://sqlite.org/src/info/0d69f76f0865f962
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/
- https://security.netapp.com/advisory/ntap-20200608-0002/
- https://usn.ubuntu.com/4394-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-26
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://support.apple.com/kb/HT211931
- https://support.apple.com/kb/HT211844
- https://support.apple.com/kb/HT211850
- https://support.apple.com/kb/HT211843
- https://support.apple.com/kb/HT211952
- http://seclists.org/fulldisclosure/2020/Nov/19
- http://seclists.org/fulldisclosure/2020/Nov/22
- http://seclists.org/fulldisclosure/2020/Nov/20
- https://support.apple.com/kb/HT211935
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: high
Reported: 2020-05-27
CVE-2020-13435
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
- https://www.sqlite.org/src/info/7a5279a25c57adf1
- https://security.netapp.com/advisory/ntap-20200528-0004/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/
- https://usn.ubuntu.com/4394-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-26
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://support.apple.com/kb/HT211931
- https://support.apple.com/kb/HT211844
- https://support.apple.com/kb/HT211850
- https://support.apple.com/kb/HT211843
- https://support.apple.com/kb/HT211952
- http://seclists.org/fulldisclosure/2020/Nov/19
- http://seclists.org/fulldisclosure/2020/Nov/22
- http://seclists.org/fulldisclosure/2020/Nov/20
- https://support.apple.com/kb/HT211935
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://www.oracle.com/security-alerts/cpuApr2021.html
Fixed version: >=1.65_03
Severity: medium
Reported: 2020-05-24
CVE-2020-13434
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
- https://www.sqlite.org/src/info/23439ea582241138
- https://www.sqlite.org/src/info/d08d3405878d394e
- https://lists.debian.org/debian-lts-announce/2020/05/msg00024.html
- https://security.netapp.com/advisory/ntap-20200528-0004/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/
- https://usn.ubuntu.com/4394-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-26
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
- https://support.apple.com/kb/HT211931
- https://support.apple.com/kb/HT211844
- https://support.apple.com/kb/HT211850
- https://support.apple.com/kb/HT211843
- https://support.apple.com/kb/HT211952
- http://seclists.org/fulldisclosure/2020/Nov/19
- http://seclists.org/fulldisclosure/2020/Nov/22
- http://seclists.org/fulldisclosure/2020/Nov/20
- https://support.apple.com/kb/HT211935
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Fixed version: >=1.65_03
Severity: medium
Reported: 2020-05-24
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
- https://www3.sqlite.org/cgi/src/info/b64674919f673602
- https://www.sqlite.org/src/info/d09f8c3621d5f7f8
- https://security.netapp.com/advisory/ntap-20200416-0001/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-26
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.tenable.com/security/tns-2021-14
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: critical
Reported: 2020-04-09
CVE-2020-11655
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
- https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11
- https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c
- https://security.netapp.com/advisory/ntap-20200416-0001/
- https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html
- https://usn.ubuntu.com/4394-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-26
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.tenable.com/security/tns-2021-14
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: high
Reported: 2020-04-09
CVE-2020-9327
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
- https://www.sqlite.org/cgi/src/info/4374860b29383380
- https://www.sqlite.org/cgi/src/info/abc473fb8fb99900
- https://www.sqlite.org/cgi/src/info/9d0d4ab95dc0c56e
- https://security.netapp.com/advisory/ntap-20200313-0002/
- https://security.gentoo.org/glsa/202003-16
- https://usn.ubuntu.com/4298-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: high
Reported: 2020-02-21
CVE-2019-8457
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
- https://www.sqlite.org/src/info/90acdbfce9c08858
- https://www.sqlite.org/releaselog/3_28_0.html
- https://usn.ubuntu.com/4004-1/
- https://usn.ubuntu.com/4004-2/
- https://security.netapp.com/advisory/ntap-20190606-0002/
- https://usn.ubuntu.com/4019-1/
- https://usn.ubuntu.com/4019-2/
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
Fixed version: >=1.63_04
Severity: critical
Reported: 2019-05-30
CVE-2019-19646
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
- https://github.com/sqlite/sqlite/commit/ebd70eedd5d6e6a890a670b5ee874a5eae86b4dd
- https://github.com/sqlite/sqlite/commit/926f796e8feec15f3836aa0a060ed906f8ae04d3
- https://www.sqlite.org/
- https://security.netapp.com/advisory/ntap-20191223-0001/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.tenable.com/security/tns-2021-14
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: critical
Reported: 2019-12-09
CVE-2019-19645
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
- https://github.com/sqlite/sqlite/commit/38096961c7cd109110ac21d3ed7dad7e0cb0ae06
- https://security.netapp.com/advisory/ntap-20191223-0001/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://usn.ubuntu.com/4394-1/
- https://www.tenable.com/security/tns-2021-14
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Fixed version: >=1.65_03
Severity: medium
Reported: 2019-12-09
CVE-2018-20506
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
- https://support.apple.com/kb/HT209451
- https://support.apple.com/kb/HT209450
- https://support.apple.com/kb/HT209448
- https://support.apple.com/kb/HT209447
- https://support.apple.com/kb/HT209446
- https://support.apple.com/kb/HT209443
- https://sqlite.org/src/info/940f2adc8541a838
- https://seclists.org/bugtraq/2019/Jan/39
- https://seclists.org/bugtraq/2019/Jan/33
- https://seclists.org/bugtraq/2019/Jan/32
- https://seclists.org/bugtraq/2019/Jan/31
- https://seclists.org/bugtraq/2019/Jan/29
- https://seclists.org/bugtraq/2019/Jan/28
- http://www.securityfocus.com/bid/106698
- http://seclists.org/fulldisclosure/2019/Jan/69
- http://seclists.org/fulldisclosure/2019/Jan/68
- http://seclists.org/fulldisclosure/2019/Jan/67
- http://seclists.org/fulldisclosure/2019/Jan/66
- http://seclists.org/fulldisclosure/2019/Jan/64
- http://seclists.org/fulldisclosure/2019/Jan/62
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
- https://security.netapp.com/advisory/ntap-20190502-0004/
- https://usn.ubuntu.com/4019-1/
- https://usn.ubuntu.com/4019-2/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
Fixed version: >=1.61_01
Severity: high
Reported: 2019-04-03
CVE-2018-20346
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
- https://www.sqlite.org/releaselog/3_25_3.html
- https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html
- https://crbug.com/900910
- https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e
- https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1659677
- https://bugzilla.redhat.com/show_bug.cgi?id=1659379
- https://blade.tencent.com/magellan/index_en.html
- https://access.redhat.com/articles/3758321
- https://worthdoingbadly.com/sqlitebug/
- https://sqlite.org/src/info/d44318f59044162e
- https://sqlite.org/src/info/940f2adc8541a838
- https://news.ycombinator.com/item?id=18685296
- https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html
- https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html
- https://www.synology.com/security/advisory/Synology_SA_18_61
- http://www.securityfocus.com/bid/106323
- https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
- https://security.gentoo.org/glsa/201904-21
- https://usn.ubuntu.com/4019-1/
- https://usn.ubuntu.com/4019-2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
- https://support.apple.com/HT209448
- https://support.apple.com/HT209447
- https://support.apple.com/HT209446
- https://support.apple.com/HT209451
- https://support.apple.com/HT209443
- https://support.apple.com/HT209450
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
Fixed version: >=1.61_01
Severity: high
Reported: 2018-12-21
CVE-2016-6153
os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
- http://www.openwall.com/lists/oss-security/2016/07/01/1
- http://www.securityfocus.com/bid/91546
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGQTH7V45QVHFDXJAEECHEO3HHD644WZ/
- https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt
- https://www.sqlite.org/releaselog/3_13_0.html
- http://www.sqlite.org/cgi/src/info/67985761aa93fb61
- http://www.openwall.com/lists/oss-security/2016/07/01/2
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00053.html
- https://www.tenable.com/security/tns-2016-20
- https://usn.ubuntu.com/4019-1/
- https://usn.ubuntu.com/4019-2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
Fixed version: >=1.51_05
Severity: medium
Reported: 2016-09-26
Kwalitee Issues
No Core Issues.
- meta_yml_declares_perl_version
-
If you are using Build.PL define the {requires}{perl} = VERSION field. If you are using MakeMaker (Makefile.PL) you should upgrade ExtUtils::MakeMaker to 6.48 and use MIN_PERL_VERSION parameter. Perl::MinimumVersion can help you determine which version of Perl your module needs.
- use_warnings
-
Add 'use warnings' (or its equivalents) to all modules, or convince us that your favorite module is well-known enough and people can easily see the modules warn when something bad happens.
Error: DBD::SQLite
- meta_yml_has_provides
-
Add all modules contained in this distribution to the META.yml field 'provides'. Module::Build or Dist::Zilla::Plugin::MetaProvides do this automatically for you.
Modules
Name | Abstract | Version | View |
---|---|---|---|
DBD::SQLite | Self-contained RDBMS in a DBI Driver | 1.59_02 | metacpan |
DBD::SQLite::Constants | common SQLite constants | metacpan | |
DBD::SQLite::GetInfo | metacpan | ||
DBD::SQLite::VirtualTable | SQLite virtual tables implemented in Perl | 1.59_02 | metacpan |
DBD::SQLite::VirtualTable::FileContent | virtual table for viewing file contents | metacpan | |
DBD::SQLite::VirtualTable::PerlData | virtual table hooked to Perl data | metacpan |