]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
MFC r362095, r362145
authorCy Schubert <cy@FreeBSD.org>
Mon, 15 Jun 2020 03:10:53 +0000 (03:10 +0000)
committerCy Schubert <cy@FreeBSD.org>
Mon, 15 Jun 2020 03:10:53 +0000 (03:10 +0000)
commit92051b1ccd9637643e544ce8b7fed43cc892660a
treeae8290d173d51f48121af685663421175486132e
parent49b4ad5b3bfdcb8f8f6117c28a19dde336f895db
MFC r362095, r362145

r362095:
MFV r362082:

Update sqlite3 3.31.1 --> 3.32.0.

PR: 247149
Reported by: spam123@bitbert.com
Reminded by: emaste
Security: CVE-2020-11655, CVE-2020-13434, CVE-2020-13435,
CVE-2020-13630, CVE-2020-13631, CVE-2020-13632

r362145:
MFV r362143:

Update sqlite3 to 3.32.2 (3320200).

CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of
service (segmentation fault) via a malformed window-function query because
the AggInfo object's initialization is mishandled.

CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in
sqlite3_str_vappendf in printf.c.

CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in
sqlite3ExprCodeTarget in expr.c.

CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a
use-after-free in fts3EvalNextRow, related to the snippet feature

CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed
to the name of one of its shadow tables, related to alter.c and build.c.

CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 ha s a
NULL pointer dereference via a crafted matchinfo() query.

PR: 247149
Reported by: spam123@bitbert.com
Security: vuxml: c4ac9c79-ab37-11ea-8b5e-b42e99a1b9c3
https://nvd.nist.gov/vuln/detail/CVE-2020-11655
https://nvd.nist.gov/vuln/detail/CVE-2020-13434
https://nvd.nist.gov/vuln/detail/CVE-2020-13435
https://nvd.nist.gov/vuln/detail/CVE-2020-13630
https://nvd.nist.gov/vuln/detail/CVE-2020-13631
https://nvd.nist.gov/vuln/detail/CVE-2020-13632
contrib/sqlite3/Makefile.msc
contrib/sqlite3/configure
contrib/sqlite3/configure.ac
contrib/sqlite3/shell.c
contrib/sqlite3/sqlite3.c
contrib/sqlite3/sqlite3.h
contrib/sqlite3/sqlite3ext.h
contrib/sqlite3/tea/configure
contrib/sqlite3/tea/configure.ac
contrib/sqlite3/tea/generic/tclsqlite3.c