Security update for sqlite3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0973-1 Final 1 1 2019-04-17T12:44:32Z current 2019-04-17T12:44:32Z 2019-04-17T12:44:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sqlite3 This update for sqlite3 fixes the following issues: Security issues fixed: - CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled (bsc#1131576). - CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687). - CVE-2016-6153: Fixed incorrect permissions when creating temporary files (bsc#987394). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-973,SUSE-SLE-SERVER-12-2019-973 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190973-1/ Link for SUSE-SU-2019:0973-1 https://lists.suse.com/pipermail/sle-security-updates/2019-April/005346.html E-Mail link for SUSE-SU-2019:0973-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1119687 SUSE Bug 1119687 https://bugzilla.suse.com/1131576 SUSE Bug 1131576 https://bugzilla.suse.com/987394 SUSE Bug 987394 https://www.suse.com/security/cve/CVE-2016-6153/ SUSE CVE CVE-2016-6153 page https://www.suse.com/security/cve/CVE-2018-20346/ SUSE CVE CVE-2018-20346 page https://www.suse.com/security/cve/CVE-2018-20506/ SUSE CVE CVE-2018-20506 page SUSE Linux Enterprise Server 12-LTSS libsqlite3-0-3.8.3.1-2.7.1 libsqlite3-0-32bit-3.8.3.1-2.7.1 libsqlite3-0-64bit-3.8.3.1-2.7.1 sqlite3-3.8.3.1-2.7.1 sqlite3-devel-3.8.3.1-2.7.1 sqlite3-doc-3.8.3.1-2.7.1 libsqlite3-0-3.8.3.1-2.7.1 as a component of SUSE Linux Enterprise Server 12-LTSS libsqlite3-0-32bit-3.8.3.1-2.7.1 as a component of SUSE Linux Enterprise Server 12-LTSS sqlite3-3.8.3.1-2.7.1 as a component of SUSE Linux Enterprise Server 12-LTSS os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files. CVE-2016-6153 SUSE Linux Enterprise Server 12-LTSS:libsqlite3-0-3.8.3.1-2.7.1 SUSE Linux Enterprise Server 12-LTSS:libsqlite3-0-32bit-3.8.3.1-2.7.1 SUSE Linux Enterprise Server 12-LTSS:sqlite3-3.8.3.1-2.7.1 low 3.3 AV:L/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190973-1/ https://www.suse.com/security/cve/CVE-2016-6153.html CVE-2016-6153 https://bugzilla.suse.com/1149969 SUSE Bug 1149969 https://bugzilla.suse.com/987394 SUSE Bug 987394 SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan. CVE-2018-20346 SUSE Linux Enterprise Server 12-LTSS:libsqlite3-0-3.8.3.1-2.7.1 SUSE Linux Enterprise Server 12-LTSS:libsqlite3-0-32bit-3.8.3.1-2.7.1 SUSE Linux Enterprise Server 12-LTSS:sqlite3-3.8.3.1-2.7.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190973-1/ https://www.suse.com/security/cve/CVE-2018-20346.html CVE-2018-20346 https://bugzilla.suse.com/1119687 SUSE Bug 1119687 https://bugzilla.suse.com/1120335 SUSE Bug 1120335 https://bugzilla.suse.com/1131576 SUSE Bug 1131576 https://bugzilla.suse.com/1131918 SUSE Bug 1131918 https://bugzilla.suse.com/1131919 SUSE Bug 1131919 https://bugzilla.suse.com/1148893 SUSE Bug 1148893 https://bugzilla.suse.com/1169664 SUSE Bug 1169664 SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346. CVE-2018-20506 SUSE Linux Enterprise Server 12-LTSS:libsqlite3-0-3.8.3.1-2.7.1 SUSE Linux Enterprise Server 12-LTSS:libsqlite3-0-32bit-3.8.3.1-2.7.1 SUSE Linux Enterprise Server 12-LTSS:sqlite3-3.8.3.1-2.7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190973-1/ https://www.suse.com/security/cve/CVE-2018-20506.html CVE-2018-20506 https://bugzilla.suse.com/1131560 SUSE Bug 1131560 https://bugzilla.suse.com/1131576 SUSE Bug 1131576