CVE-2025-29087

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

Root has patched CVE-2025-29087 in the sqlite package for Root:Alpine:3.18. Multiple fixed versions available.

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

These are all security issues fixed in the libsqlite3-0-3.49.1-3.1 package on the GA media of openSUSE Tumbleweed.

This update for sqlite3 fixes the following issues:

• CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function (bsc#1241020)
• CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

Other fixes:

• Updated to version 3.49.1 from Factory (jsc#SLE-16032)

This update for sqlite3 fixes the following issues:

• CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function (bsc#1241020)
• CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

Other fixes:

• Updated to version 3.49.1 from Factory (jsc#SLE-16032)

This update for sqlite3 fixes the following issues:

• CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function (bsc#1241020)
• CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

Other fixes:

• Updated to version 3.49.1 from Factory (jsc#SLE-16032)

This update for sqlite3 fixes the following issues:

• CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function (bsc#1241020)
• CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

Other fixes:

• Updated to version 3.49.1 from Factory (jsc#SLE-16032)

This update for sqlite3 fixes the following issues:

• CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function (bsc#1241020)
• CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

Other fixes:

• Updated to version 3.49.1 from Factory (jsc#SLE-16032)

This update for sqlite3 fixes the following issues:

• Update to release 3.49.1:

  • Improve portability of makefiles and configure scripts.
  • CVE-2025-29087, bsc#1241020: Fix a bug in the concat_ws() function, introduced in version 3.44.0, that could lead to a memory error if the separator string is very large (hundreds of megabytes).
  • CVE-2025-29088, bsc#1241078: Enhanced the SQLITE_DBCONFIG_LOOKASIDE interface to make it more robust against misuse.

• Update to release 3.49.0:

  • Enhancements to the query planner:
    • Improve the query-time index optimization so that it works on WITHOUT ROWID tables.
    • Better query plans for large star-query joins. This fixes three different performance regressions that were reported on the SQLite Forum.
    • When two or more queries have the same estimated cost, use the one with the fewer bytes per row.
  • Enhance the iif() SQL function so that it can accept any number of arguments greater than or equal to two.
  • Enhance the session extension so that it works on databases that make use of generated columns.
  • Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which was not implemented correctly and never worked right. In its place add the SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This option applies to command-line tools like the CLI only, not to the SQLite core. It causes Win32 APIs to be used for console I/O instead of stdio. This option affects Windows builds only.
  • Three new options to sqlite3_db_config(). All default "on". SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE SQLITE_DBCONFIG_ENABLE_COMMENTS

• Re-enable SONAME which got disabled by default in 3.48.0.

  • https://www.sqlite.org/src/forumpost/5a3b44f510df8ded
  • https://sqlite.org/forum/forumpost/ab8f15697a

• Update to release 3.48.0:

  • Improved EXPLAIN QUERY PLAN output for covering indexes.
  • Allow a two-argument version of the iif() SQL function.
  • Also allow if() as an alternative spelling for iif().
  • Add the ".dbtotxt" command to the CLI.
  • Add the SQLITE_IOCAP_SUBPAGE_READ property to the xDeviceCharacteristics method of the sqlite3_io_methods object.
  • Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3() that prevents warning messages being sent to the error log if the SQL is ill-formed. This allows sqlite3_prepare_v3() to be used to do test compiles of SQL to check for validity without polluting the error log with false messages.
  • Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from 1 to 30.
  • Added the SQLITE_FCNTL_NULL_IO file control.
  • Extend the FTS5 auxiliary API xInstToken() to work with prefix queries via the insttoken configuration option and the fts5_insttoken() SQL function.
  • Increase the maximum number of arguments to an SQL function from 127 to 1000.

• Update to release 3.47.2:

  • Fix a problem in text-to-floating-point conversion that affects text values where the first 16 significant digits are '1844674407370955'. This issue was introduced in 3.47.0 and only arises on x64 and i386 hardware.
  • Other minor bug fixes.

• Enable the session extension, because NodeJS 22 needs it.

• Update to release 3.47.1:

  • Fix the makefiles so that they once again honored DESTDIR for the "install" target.
  • Add the SQLITE_IOCAP_SUBPAGE_READ capability to the VFS, to work around issues on some non-standard VFSes caused by making SQLITE_DIRECT_OVERFLOW_READ the default in version 3.45.0.
  • Fix incorrect answers to certain obscure IN queries caused by new query optimizations added in the 3.47.0 release.
  • Other minor bug fixes.

• Update to release 3.47.0:

  • Allow arbitrary expressions in the second argument to the RAISE function.
  • If the RHS of the ->> operator is negative, then access array elements counting from the right.
  • Fix a…

This update for sqlite3 fixes the following issues:

• Update to release 3.49.1:

  • Improve portability of makefiles and configure scripts.
  • CVE-2025-29087: Fixed Integer Overflow in SQLite concat Function (bsc#1241020)
  • CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

• Update to release 3.49.0:

  • Enhancements to the query planner:
    • Improve the query-time index optimization so that it works on WITHOUT ROWID tables.
    • Better query plans for large star-query joins. This fixes three different performance regressions that were reported on the SQLite Forum.
    • When two or more queries have the same estimated cost, use the one with the fewer bytes per row.
  • Enhance the iif() SQL function so that it can accept any number of arguments greater than or equal to two.
  • Enhance the session extension so that it works on databases that make use of generated columns.
  • Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which was not implemented correctly and never worked right. In its place add the SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This option applies to command-line tools like the CLI only, not to the SQLite core. It causes Win32 APIs to be used for console I/O instead of stdio. This option affects Windows builds only.
  • Three new options to sqlite3_db_config(). All default "on". SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE SQLITE_DBCONFIG_ENABLE_COMMENTS

• Re-enable SONAME which got disabled by default in 3.48.0.

• Update to release 3.48.0:

  • Improved EXPLAIN QUERY PLAN output for covering indexes.
  • Allow a two-argument version of the iif() SQL function.
  • Also allow if() as an alternative spelling for iif().
  • Add the ".dbtotxt" command to the CLI.
  • Add the SQLITE_IOCAP_SUBPAGE_READ property to the xDeviceCharacteristics method of the sqlite3_io_methods object.
  • Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3() that prevents warning messages being sent to the error log if the SQL is ill-formed. This allows sqlite3_prepare_v3() to be used to do test compiles of SQL to check for validity without polluting the error log with false messages.
  • Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from 1 to 30.
  • Added the SQLITE_FCNTL_NULL_IO file control.
  • Extend the FTS5 auxiliary API xInstToken() to work with prefix queries via the insttoken configuration option and the fts5_insttoken() SQL function.
  • Increase the maximum number of arguments to an SQL function from 127 to 1000.

• Update to release 3.47.2:

  • Fix a problem in text-to-floating-point conversion that affects text values where the first 16 significant digits are '1844674407370955'. This issue was introduced in 3.47.0 and only arises on x64 and i386 hardware.
  • Other minor bug fixes.

• Enable the session extension, because NodeJS 22 needs it.

• Update to release 3.47.1:

  • Fix the makefiles so that they once again honored DESTDIR for the "install" target.
  • Add the SQLITE_IOCAP_SUBPAGE_READ capability to the VFS, to work around issues on some non-standard VFSes caused by making SQLITE_DIRECT_OVERFLOW_READ the default in version 3.45.0.
  • Fix incorrect answers to certain obscure IN queries caused by new query optimizations added in the 3.47.0 release.
  • Other minor bug fixes.

• Update to release 3.47.0:

  • Allow arbitrary expressions in the second argument to the RAISE function.
  • If the RHS of the ->> operator is negative, then access array elements counting from the right.
  • Fix a problem with rolling back hot journal files in the seldom-used unix-dotfile VFS.
  • FTS5 tables can now be dropped even if they use a non-standard tokenizer that has not been registered.
  • Fix the group_concat() aggregate function so that it returns an…

It was discovered that SQLite incorrectly handled the concat_ws() function. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-29087, CVE-2025-3277)

It was discovered that SQLite incorrectly handled certain argument values to sqlite3_db_config(). An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-29088)