CVE-2022-35737

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

SQLite is a C-language library that implements a small, fast, self-contained,high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.

Security Fix(es):

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.(CVE-2022-35737)

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2022-35737 in the sqlite3 package for Root:Debian:11. Multiple fixed versions available.

It was sometimes possible for SQLite versions >= 1.0.12, < 3.39.2 to allow an array-bounds overflow when large string were input into SQLite's printf function.

As libsqlite3-sys bundles SQLite, it is susceptible to the vulnerability. libsqlite3-sys was updated to bundle the patched version of SQLite here.

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

• CVE-2022-35737: fix a buffer overflow

• SECURITY UPDATE: array-bounds overflow if billions of bytes are used in a string argument to a C API
  • debian/patches/CVE-2022-35737.patch: increase the size of loop variables in the printf() implementation to avoid overflow.
  • CVE-2022-35737

• CVE-2022-35737: fix a buffer overflow

• CVE-2022-35737: fix a buffer overflow

• CVE-2022-35737: fix a buffer overflow

• CVE-2022-35737: increase the size of loop variables in the printf() implementation

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

It was discovered that sqlite contained an assertion failure upon queries when compiled with -DSQLITE_ENABLE_STAT4 (CVE-2022-35737).

These are all security issues fixed in the libsqlite3-0-3.39.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for sqlite3 fixes the following issues:

Security issues fixed:

• CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).

• CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

sqlite was updated to 3.39.3:

• Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort.
• Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe.

Update to 3.39.2:

• Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN.
• Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783]

Update to 3.39.1:

• Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view
• Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
• Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
• Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding.
• Enhance the sqlite_stmt virtual table so that it buffers all of its output.

Update to 3.39.0:

• Add (long overdue) support for RIGHT and FULL OUTER JOIN
• Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards
• Add a new return code (value '3') from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses
• Added the sqlite3_db_name() interface
• The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened
• Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used
• The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause
• Many microoptimizations collectively reduce CPU cycles by about 2.3%.

Update to 3.38.5:

• Fix a blunder in the CLI of the 3.38.4 release

Update to 3.38.4:

• fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key

Update to 3.38.3:

• Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output.
• Other minor patches. See the timeline for details.

Update to 3.38.2:

• Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL.
• Other minor patches.

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

Update to 3.38.1:

• Fix problems with the new Bloom filter optimization that might …

This update for sqlite3 fixes the following issues:

Security issues fixed:

• CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).

• CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

sqlite was updated to 3.39.3:

• Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort.
• Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe.

Update to 3.39.2:

• Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN.
• Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783]

Update to 3.39.1:

• Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view
• Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
• Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
• Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding.
• Enhance the sqlite_stmt virtual table so that it buffers all of its output.

Update to 3.39.0:

• Add (long overdue) support for RIGHT and FULL OUTER JOIN
• Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards
• Add a new return code (value '3') from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses
• Added the sqlite3_db_name() interface
• The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened
• Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used
• The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause
• Many microoptimizations collectively reduce CPU cycles by about 2.3%.

Update to 3.38.5:

• Fix a blunder in the CLI of the 3.38.4 release

Update to 3.38.4:

• fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key

Update to 3.38.3:

• Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output.
• Other minor patches. See the timeline for details.

Update to 3.38.2:

• Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL.
• Other minor patches.

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

Update to 3.38.1:

• Fix problems with the new Bloom filter optimization that might …

This update for sqlite3 fixes the following issues:

Security issues fixed:

• CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).

• CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

sqlite3 was update to 3.39.3:

• Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort.
• Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe.

Update to 3.39.2:

• Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN.
• Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783]

Update to 3.39.1:

• Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view
• Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
• Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
• Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding.
• Enhance the sqlite_stmt virtual table so that it buffers all of its output.

Update to 3.39.0:

• Add (long overdue) support for RIGHT and FULL OUTER JOIN
• Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards
• Add a new return code (value '3') from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses
• Added the sqlite3_db_name() interface
• The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened
• Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used
• The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause
• Many microoptimizations collectively reduce CPU cycles by about 2.3%.

Update to 3.38.5:

• Fix a blunder in the CLI of the 3.38.4 release

Update to 3.38.4:

• fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key

Update to 3.38.3:

• Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output.
• Other minor patches. See the timeline for details.

Update to 3.38.2:

• Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL.
• Other minor patches.

• Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

Update to 3.38.1:

• Fix problems with the new Bloom filter optimization that might …

It was discovered that SQLite did not properly handle large string inputs in certain circumstances. An attacker could possibly use this issue to cause a denial of service or arbitrary code execution.

It was discovered that SQLite incorrectly handled certain long string arguments. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-5716-1 fixed a vulnerability in SQLite. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that SQLite incorrectly handled certain long string arguments. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.