CVE-2021-36690

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

** DISPUTED ** A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

As the cve assignment is disputed, this update may be changed in future from a security update to a bugfix update.

These are all security issues fixed in the libsqlite3-0-3.39.3-2.1 package on the GA media of openSUSE Tumbleweed.

This update for sqlite3 fixes the following issues:

Security issues fixed:

• CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).

• CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

sqlite was updated to 3.39.3:

• Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort.
• Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe.

Update to 3.39.2:

• Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN.
• Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783]

Update to 3.39.1:

• Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view
• Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
• Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
• Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding.
• Enhance the sqlite_stmt virtual table so that it buffers all of its output.

Update to 3.39.0:

• Add (long overdue) support for RIGHT and FULL OUTER JOIN
• Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards
• Add a new return code (value '3') from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses
• Added the sqlite3_db_name() interface
• The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened
• Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used
• The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause
• Many microoptimizations collectively reduce CPU cycles by about 2.3%.

Update to 3.38.5:

• Fix a blunder in the CLI of the 3.38.4 release

Update to 3.38.4:

• fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key

Update to 3.38.3:

• Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output.
• Other minor patches. See the timeline for details.

Update to 3.38.2:

• Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL.
• Other minor patches.

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

Update to 3.38.1:

• Fix problems with the new Bloom filter optimization that might …

This update for sqlite3 fixes the following issues:

Security issues fixed:

• CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).

• CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

sqlite was updated to 3.39.3:

• Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort.
• Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe.

Update to 3.39.2:

• Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN.
• Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783]

Update to 3.39.1:

• Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view
• Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
• Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
• Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding.
• Enhance the sqlite_stmt virtual table so that it buffers all of its output.

Update to 3.39.0:

• Add (long overdue) support for RIGHT and FULL OUTER JOIN
• Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards
• Add a new return code (value '3') from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses
• Added the sqlite3_db_name() interface
• The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened
• Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used
• The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause
• Many microoptimizations collectively reduce CPU cycles by about 2.3%.

Update to 3.38.5:

• Fix a blunder in the CLI of the 3.38.4 release

Update to 3.38.4:

• fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key

Update to 3.38.3:

• Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output.
• Other minor patches. See the timeline for details.

Update to 3.38.2:

• Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL.
• Other minor patches.

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

Update to 3.38.1:

• Fix problems with the new Bloom filter optimization that might …

This update for sqlite3 fixes the following issues:

Security issues fixed:

• CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).

• CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

sqlite3 was update to 3.39.3:

• Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort.
• Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe.

Update to 3.39.2:

• Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN.
• Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783]

Update to 3.39.1:

• Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view
• Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
• Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
• Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding.
• Enhance the sqlite_stmt virtual table so that it buffers all of its output.

Update to 3.39.0:

• Add (long overdue) support for RIGHT and FULL OUTER JOIN
• Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards
• Add a new return code (value '3') from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses
• Added the sqlite3_db_name() interface
• The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened
• Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used
• The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause
• Many microoptimizations collectively reduce CPU cycles by about 2.3%.

Update to 3.38.5:

• Fix a blunder in the CLI of the 3.38.4 release

Update to 3.38.4:

• fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key

Update to 3.38.3:

• Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output.
• Other minor patches. See the timeline for details.

Update to 3.38.2:

• Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL.
• Other minor patches.

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

Update to 3.38.1:

• Fix problems with the new Bloom filter optimization that might …

It was discovered that SQLite command-line component incorrectly handled certain queries. An attacker could possibly use this issue to cause a crash or possibly execute arbitrary code.