]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
MFV r362143:
authorCy Schubert <cy@FreeBSD.org>
Sat, 13 Jun 2020 04:47:59 +0000 (04:47 +0000)
committerCy Schubert <cy@FreeBSD.org>
Sat, 13 Jun 2020 04:47:59 +0000 (04:47 +0000)
commit9236bd4bb7756d897985a8a4232593ef806b1ec0
tree94756ebd07e1e241b9c7c49acb434962f66d0f8a
parent8bc0d2b8553e012412d03468f84588dc34dea4c4
parent1c35d1a9f69c75801a843cf1614fb838e43b3d45
MFV r362143:

Update sqlite3 to 3.32.2 (3320200).

CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of
service (segmentation fault) via a malformed window-function query because
the AggInfo object's initialization is mishandled.

CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in
sqlite3_str_vappendf in printf.c.

CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in
sqlite3ExprCodeTarget in expr.c.

CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a
use-after-free in fts3EvalNextRow, related to the snippet feature

CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed
to the name of one of its shadow tables, related to alter.c and build.c.

CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 ha s a
NULL pointer dereference via a crafted matchinfo() query.

PR: 247149
Reported by: spam123@bitbert.com
MFC after: 3 days
Security: vuxml: c4ac9c79-ab37-11ea-8b5e-b42e99a1b9c3
https://nvd.nist.gov/vuln/detail/CVE-2020-11655
https://nvd.nist.gov/vuln/detail/CVE-2020-13434
https://nvd.nist.gov/vuln/detail/CVE-2020-13435
https://nvd.nist.gov/vuln/detail/CVE-2020-13630
https://nvd.nist.gov/vuln/detail/CVE-2020-13631
https://nvd.nist.gov/vuln/detail/CVE-2020-13632
contrib/sqlite3/configure
contrib/sqlite3/configure.ac
contrib/sqlite3/shell.c
contrib/sqlite3/sqlite3.c
contrib/sqlite3/sqlite3.h
contrib/sqlite3/tea/configure
contrib/sqlite3/tea/configure.ac