Summary
Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL.
Impacted versions :
3.6.14.1-3.41.2.1 References
https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where sqlite3step(pStmt)==SQLITEROW is false and a data structure is never initialized.
An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.
In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.
Last updated 24 July 2024
SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
DISPUTED A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
End of life: 9/28/2001, Latest version: 1.0.32
End of life: 9/28/2001, Latest version: 1.0.32
End of life: 9/18/2004, Latest version: 2.8.17
End of life: 9/18/2004, Latest version: 2.8.17