{"id":"CVE-2022-35737","aliases":["ALPINE-CVE-2022-35737","ALSA-2023:0110","ALSA-2023:0339","AZL-10467","BELL-CVE-2022-35737","BIT-sqlite-2022-35737","CLSA-2022-1668116271","CLSA-2022-1668118023","CLSA-2022-1668121215","CLSA-2022-1668122377","CLSA-2022-1668468398","CLSA-2023-1698946014","DEBIAN-CVE-2022-35737","EUVD-2022-6580","GHSA-jw36-hf63-69r9","MGASA-2022-0273","OESA-2022-1909","RHSA-2023:0110","RHSA-2023:0339","RHSA-2024:0425","RLSA-2023:0110","RLSA-2023:0339","ROOT-OS-DEBIAN-11-CVE-2022-35737","RUSTSEC-2022-0090","SUSE-SU-2022:3307-1","SUSE-SU-2022:3307-2","SUSE-SU-2022:3401-1","UBUNTU-CVE-2022-35737","USN-5712-1","USN-5716-1","USN-5716-2","openSUSE-SU-2024:12210-1"],"status":"published","title":"`libsqlite3-sys` via C SQLite improperly validates array index","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.23575,"percentile":0.97821,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-129"],"published":"2022-08-03T00:00:00Z","modified":"2026-11-03T07:30:37Z","exploits":[{"source":"pocgithub","id":"gmh5225/CVE-2022-35737","title":"gmh5225/CVE-2022-35737","date":"2022-10-24","url":"https://github.com/gmh5225/CVE-2022-35737"},{"source":"pocgithub","id":"rvermeulen/codeql-cve-2022-35737","title":"rvermeulen/codeql-cve-2022-35737","date":"2023-02-21","url":"https://github.com/rvermeulen/codeql-cve-2022-35737"}],"fixes":[{"ecosystem":"crates.io","package":"libsqlite3-sys","fixed_in":["0.25.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220505-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"qt5-qtwebengine","fixed_in":["5.15.11-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"qt5-qtwebengine","fixed_in":["5.15.11-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"qt5-qtwebengine","fixed_in":["5.15.11-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"qt5-qtwebengine","fixed_in":["5.15.11-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"qt5-qtwebengine","fixed_in":["5.15.11-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"qt5-qtwebengine","fixed_in":["5.15.11-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qt5-qtwebengine","fixed_in":["5.15.11-r3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lemon","fixed_in":["3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"sqlite","fixed_in":["3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"sqlite-devel","fixed_in":["3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"sqlite-doc","fixed_in":["3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"sqlite-libs","fixed_in":["3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"sqlite","fixed_in":["3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"sqlite-devel","fixed_in":["3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"sqlite-libs","fixed_in":["3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"sqlite","fixed_in":["3.39.2-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"sqlite","fixed_in":["3.39.2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"lemon","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"sqlite","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"sqlite-devel","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"sqlite-doc","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"sqlite-tcl","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"lemon","fixed_in":["3.11.0-1ubuntu1.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libsqlite3-0","fixed_in":["3.11.0-1ubuntu1.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libsqlite3-dev","fixed_in":["3.11.0-1ubuntu1.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libsqlite3-tcl","fixed_in":["3.11.0-1ubuntu1.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"sqlite3","fixed_in":["3.11.0-1ubuntu1.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"sqlite3-doc","fixed_in":["3.11.0-1ubuntu1.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"lemon","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"sqlite","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"sqlite-devel","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"sqlite-doc","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"sqlite-tcl","fixed_in":["3.6.20-1.el6_7.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"lemon","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"sqlite","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-analyzer","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-devel","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-doc","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-libs","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-tcl","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"lemon","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"sqlite","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-analyzer","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-devel","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-doc","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-libs","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-tcl","fixed_in":["3.26.0-15.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"lemon","fixed_in":["3.7.17-8.el7_7.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"sqlite","fixed_in":["3.7.17-8.el7_7.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"sqlite-devel","fixed_in":["3.7.17-8.el7_7.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"sqlite-doc","fixed_in":["3.7.17-8.el7_7.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"sqlite-tcl","fixed_in":["3.7.17-8.el7_7.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sqlite3","fixed_in":["3.39.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.39.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.39.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"sqlite3","fixed_in":["3.39.2-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"sqlite","fixed_in":["3.32.3-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"sqlite","fixed_in":["3.32.3-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"sqlite","fixed_in":["3.37.2-2.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lemon","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lemon-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-analyzer-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-debugsource","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-libs-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-tcl-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lemon-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-analyzer-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-debugsource","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-devel","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-doc","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-libs","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-libs-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-tcl-debuginfo","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"lemon-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-analyzer-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-debugsource","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-devel","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-libs-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-tcl-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-tools-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"lemon-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-analyzer-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-debugsource","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-libs","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-libs-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-tcl-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-tools-debuginfo","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"sqlite","fixed_in":["0:3.26.0-17.el8_7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"sqlite","fixed_in":["0:3.34.1-6.el9_1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"sqlite3","fixed_in":["3.34.1-3+deb11u1.root.io.9","3.34.1-3+deb11u1.aikido.11","3.34.1-3+deb11u1.root.io.10"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-sqlite3","fixed_in":["3.34.1-3+deb11u1.root.io.9","3.34.1-3+deb11u1.aikido.11","3.34.1-3+deb11u1.root.io.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sqlite3","fixed_in":["3.8.2-1ubuntu2.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sqlite3","fixed_in":["3.11.0-1ubuntu1.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","fixed_in":["3.22.0-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"sqlite3","fixed_in":["3.31.1-4ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"sqlite3","fixed_in":["3.37.2-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","fixed_in":["3.39.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"libsqlite3-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220505-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-r3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.12"},{"fixed":"3.39.2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libsqlite3-0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libsqlite3-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libsqlite3-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"sqlite3-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.20-1.el6_7.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-15.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.17-8.el7_7.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.17-8.el7_7.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.17-8.el7_7.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.17-8.el7_7.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.17-8.el7_7.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libsqlite3-sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.25.1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.3-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.3-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-2.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sqlite-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sqlite-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-16.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.26.0-17.el8_7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.34.1-6.el9_1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.1-3+deb11u1.root.io.9"},{"fixed":"3.34.1-3+deb11u1.aikido.11"},{"fixed":"3.34.1-3+deb11u1.root.io.10"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.1-3+deb11u1.root.io.9"},{"fixed":"3.34.1-3+deb11u1.aikido.11"},{"fixed":"3.34.1-3+deb11u1.root.io.10"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libsqlite3-sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu2.2+esm3"}]}],"versions":["3.7.17-1ubuntu1","3.8.0.2-1ubuntu1","3.8.1-1ubuntu1","3.8.1-1ubuntu3","3.8.2-1ubuntu1","3.8.2-1ubuntu2","3.8.2-1ubuntu2.1","3.8.2-1ubuntu2.2","3.8.2-1ubuntu2.2+esm1","3.8.2-1ubuntu2.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+esm2"}]}],"versions":["3.8.11.1-1","3.9.1-2","3.9.2-1","3.10.0-1","3.10.1-1","3.10.2-1","3.11.0-1ubuntu1","3.11.0-1ubuntu1.1","3.11.0-1ubuntu1.2","3.11.0-1ubuntu1.3","3.11.0-1ubuntu1.4","3.11.0-1ubuntu1.5","3.11.0-1ubuntu1.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.17-12fakesync1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-1ubuntu0.7"}]}],"versions":["3.19.3-3","3.20.1-2","3.21.0-1","3.22.0-1","3.22.0-1ubuntu0.1","3.22.0-1ubuntu0.2","3.22.0-1ubuntu0.3","3.22.0-1ubuntu0.4","3.22.0-1ubuntu0.5","3.22.0-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.1-4ubuntu0.5"}]}],"versions":["3.29.0-2","3.30.1-1","3.30.1-1ubuntu1","3.31.1-1ubuntu1","3.31.1-3","3.31.1-4","3.31.1-4ubuntu0.1","3.31.1-4ubuntu0.2","3.31.1-4ubuntu0.3","3.31.1-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-2ubuntu0.1"}]}],"versions":["3.35.5-1","3.36.0-2","3.37.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-1ubuntu1.5+esm2"}]}],"versions":["3.8.11.1-1","3.9.1-2","3.9.2-1","3.10.0-1","3.10.1-1","3.10.2-1","3.11.0-1ubuntu1","3.11.0-1ubuntu1.1","3.11.0-1ubuntu1.2","3.11.0-1ubuntu1.3","3.11.0-1ubuntu1.4","3.11.0-1ubuntu1.5","3.11.0-1ubuntu1.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-1ubuntu0.7"}]}],"versions":["3.19.3-3","3.20.1-2","3.21.0-1","3.22.0-1","3.22.0-1ubuntu0.1","3.22.0-1ubuntu0.2","3.22.0-1ubuntu0.3","3.22.0-1ubuntu0.4","3.22.0-1ubuntu0.5","3.22.0-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.1-4ubuntu0.5"}]}],"versions":["3.29.0-2","3.30.1-1","3.30.1-1ubuntu1","3.31.1-1ubuntu1","3.31.1-3","3.31.1-4","3.31.1-4ubuntu0.1","3.31.1-4ubuntu0.2","3.31.1-4ubuntu0.3","3.31.1-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-2ubuntu0.1"}]}],"versions":["3.35.5-1","3.36.0-2","3.37.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu2.2+esm3"}]}],"versions":["3.7.17-1ubuntu1","3.8.0.2-1ubuntu1","3.8.1-1ubuntu1","3.8.1-1ubuntu3","3.8.2-1ubuntu1","3.8.2-1ubuntu2","3.8.2-1ubuntu2.1","3.8.2-1ubuntu2.2","3.8.2-1ubuntu2.2+esm1","3.8.2-1ubuntu2.2+esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-1.1"}]}]}],"products":[{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"https://www.sqlite.org/cves.html","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://kb.cert.org/vuls/id/720344","tags":["x_transferred","Broken Link","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://sqlite.org/releaselog/3_39_2.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0009/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/","tags":["x_transferred","Exploit","Third Party Advisory","advisory","article","report"]},{"url":"https://security.gentoo.org/glsa/202210-40","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35737","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0090.html","tags":["web","advisory"]},{"url":"https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0009","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jw36-hf63-69r9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-35737","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0110","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-35737","tags":["report"]},{"url":"https://bugzilla.redhat.com/2110291","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0110.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0339","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-0339.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-35737","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1668116271.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2022-1668118023","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1668121215.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1668122377.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1668468398.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos7-els/CLSA-2023-1698946014.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35737.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-35737","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0273.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30660","tags":["report"]},{"url":"https://www.sqlite.org/releaselog/3_39_2.html","tags":["web","article"]},{"url":"https://sqlite.org/forum/forumpost/3607259d3c","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1909","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110291","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0110.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35737","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0339.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0425","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186385","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0425.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-24736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24736","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0110","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0339","tags":["advisory"]},{"url":"https://crates.io/crates/libsqlite3-sys","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223307-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189802","tags":["report"]},{"url":"https://bugzilla.suse.com/1195773","tags":["report"]},{"url":"https://bugzilla.suse.com/1201783","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35737","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223307-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223401-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-35737","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5712-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5716-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5716-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T00:00:00Z","modified":"2026-10-14T17:07:44.874Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-6580","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T00:00:00Z","modified":"2026-10-14T17:07:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:13.785562Z"}],"ghsa":[{"id":"GHSA-jw36-hf63-69r9","title":"`libsqlite3-sys` via C SQLite improperly validates array index","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-04T00:00:26Z","modified":"2024-03-27T18:33:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T06:15:07.69Z","modified":"2026-10-14T18:17:01.163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"ALPINE-CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T06:15:07.69Z","modified":"2026-11-03T07:30:37.664777437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-10467","title":"CVE-2022-35737 affecting package sqlite for versions less than 3.39.2-1","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T06:15:07Z","modified":"2026-04-21T04:21:21.350127Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"BELL-CVE-2022-35737","title":"CVE-2022-35737 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:21.433472Z","modified":"2026-01-26T09:50:05.99771Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T00:00:00Z","modified":"2026-10-28T02:30:54.893724146Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-jw36-hf63-69r9","title":"`libsqlite3-sys` via C SQLite improperly validates array index","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-04T00:00:26Z","modified":"2024-03-27T18:33:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"OESA-2022-1909","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained,high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\r\n\r\nSQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.(CVE-2022-35737)","status":"published","published":"2022-09-09T11:05:12Z","modified":"2026-08-18T01:17:17.903190467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2023:0110","title":"Red Hat Security Advisory: sqlite security update","status":"published","published":"2024-09-16T09:52:31Z","modified":"2026-10-15T10:03:34Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0339","title":"Red Hat Security Advisory: sqlite security update","status":"published","published":"2024-09-16T09:52:41Z","modified":"2026-10-15T10:03:38Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2024:0425","title":"Red Hat Security Advisory: sqlite security update","status":"published","published":"2024-09-16T11:51:03Z","modified":"2026-10-15T10:06:40Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RLSA-2023:0110","title":"Moderate: sqlite security update","description":"SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.\n\nSecurity Fix(es):\n\n* sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-12T08:25:38Z","modified":"2026-02-05T12:15:06.727398Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:0339","title":"Moderate: sqlite security update","description":"SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.\n\nSecurity Fix(es):\n\n* sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-23T14:30:39Z","modified":"2026-02-05T08:15:12.450059Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2022-35737","title":"CVE-2022-35737 in sqlite3 - Patched by Root","description":"Root has patched CVE-2022-35737 in the sqlite3 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:24:54Z","modified":"2026-08-23T10:19:39.666866162Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"RUSTSEC-2022-0090","title":"`libsqlite3-sys` via C SQLite CVE-2022-35737","description":"It was sometimes possible for SQLite versions \u003e= 1.0.12, \u003c 3.39.2 to allow an array-bounds overflow when large string were input into SQLite's `printf` function.\n\nAs `libsqlite3-sys` bundles SQLite, it is susceptible to the vulnerability. `libsqlite3-sys` was updated to bundle the patched version of SQLite [here](https://github.com/rusqlite/rusqlite/releases/tag/sys0.25.1).","status":"published","published":"2022-08-03T12:00:00Z","modified":"2023-12-06T01:02:25.135287Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"UBUNTU-CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T06:15:00Z","modified":"2026-10-08T12:49:18.7664866Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"ALSA-2023:0110","title":"Moderate: sqlite security update","description":"SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.\n\nSecurity Fix(es):\n\n* sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-12T00:00:00Z","modified":"2026-10-29T11:01:55.095468715Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0339","title":"Moderate: sqlite security update","description":"SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.\n\nSecurity Fix(es):\n\n* sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-23T00:00:00Z","modified":"2026-10-29T11:31:22.615219817Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"BIT-sqlite-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2024-03-06T11:06:04.084Z","modified":"2026-09-08T08:48:19.565568147Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"CLSA-2022-1668116271","title":"sqlite: Fix of CVE-2022-35737","description":"- CVE-2022-35737: fix a buffer overflow","status":"published","published":"2022-11-10T21:37:51Z","modified":"2026-06-01T00:32:44.861432812Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1668118023","title":"Fix CVE(s): CVE-2022-35737","description":"\n   * SECURITY UPDATE: array-bounds overflow if billions of bytes are\n     used in a string argument to a C API\n     - debian/patches/CVE-2022-35737.patch: increase the size of loop\n       variables in the printf() implementation to avoid overflow.\n     - CVE-2022-35737","status":"published","published":"2022-11-10T22:07:03Z","modified":"2026-06-04T10:03:29.517696Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1668121215","title":"sqlite: Fix of CVE-2022-35737","description":"- CVE-2022-35737: fix a buffer overflow","status":"published","published":"2022-11-10T23:00:15Z","modified":"2026-06-01T00:32:13.771348839Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1668122377","title":"sqlite: Fix of CVE-2022-35737","description":"- CVE-2022-35737: fix a buffer overflow","status":"published","published":"2022-11-10T23:19:37Z","modified":"2026-06-01T00:33:21.543771863Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1668468398","title":"sqlite: Fix of CVE-2022-35737","description":"- CVE-2022-35737: fix a buffer overflow","status":"published","published":"2022-11-14T23:26:38Z","modified":"2026-06-01T00:33:11.18580898Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1698946014","title":"sqlite: Fix of CVE-2022-35737","description":"- CVE-2022-35737: increase the size of loop variables in the printf()\n  implementation","status":"published","published":"2023-11-02T17:26:59Z","modified":"2026-06-01T00:33:17.337635789Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"DEBIAN-CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","status":"published","published":"2022-08-03T06:15:07.69Z","modified":"2026-11-03T06:02:56.241223038Z","updated_at":"2026-11-03T06:43:19.563245Z"},{"id":"MGASA-2022-0273","title":"Updated sqlite3 packages fix security vulnerability","description":"It was discovered that sqlite contained an assertion failure upon queries\nwhen compiled with -DSQLITE_ENABLE_STAT4 (CVE-2022-35737).\n","status":"published","published":"2022-08-05T21:00:44Z","modified":"2026-04-16T04:43:56.374871413Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12210-1","title":"libsqlite3-0-3.39.2-1.1 on GA media","description":"These are all security issues fixed in the libsqlite3-0-3.39.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:25:46.242558Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3307-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).\n- CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).\n  \n- Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).\n\nsqlite was updated to 3.39.3:\n\n* Use a statement journal on DML statement affecting two or more\n  database rows if the statement makes use of a SQL functions\n  that might abort.\n* Use a mutex to protect the PRAGMA temp_store_directory and\n  PRAGMA data_store_directory statements, even though they are\n  decremented and documented as not being threadsafe.\n\nUpdate to 3.39.2:\n\n* Fix a performance regression in the query planner associated\n  with rearranging the order of FROM clause terms in the\n  presences of a LEFT JOIN.\n* Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and\n  1345947, forum post 3607259d3c, and other minor problems\n  discovered by internal testing. [boo#1201783]\n\nUpdate to 3.39.1:\n\n* Fix an incorrect result from a query that uses a view that\n  contains a compound SELECT in which only one arm contains a\n  RIGHT JOIN and where the view is not the first FROM clause term\n  of the query that contains the view\n* Fix a long-standing problem with ALTER TABLE RENAME that can\n  only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set\n  to a very small value.\n* Fix a long-standing problem in FTS3 that can only arise when\n  compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time\n  option.\n* Fix the initial-prefix optimization for the REGEXP extension so\n  that it works correctly even if the prefix contains characters\n  that require a 3-byte UTF8 encoding.\n* Enhance the sqlite_stmt virtual table so that it buffers all of\n  its output. \n\nUpdate to 3.39.0:\n\n* Add (long overdue) support for RIGHT and FULL OUTER JOIN\n* Add new binary comparison operators IS NOT DISTINCT FROM and \n  IS DISTINCT FROM that are equivalent to IS and IS NOT, \n  respective, for compatibility with PostgreSQL and SQL standards\n* Add a new return code (value '3') from the sqlite3_vtab_distinct()\n  interface that indicates a query that has both DISTINCT and \n  ORDER BY clauses\n* Added the sqlite3_db_name() interface\n* The unix os interface resolves all symbolic links in database\n  filenames to create a canonical name for the database before\n  the file is opened\n* Defer materializing views until the materialization is actually\n  needed, thus avoiding unnecessary work if the materialization\n  turns out to never be used\n* The HAVING clause of a SELECT statement is now allowed on any\n  aggregate query, even queries that do not have a GROUP BY\n  clause\n* Many microoptimizations collectively reduce CPU cycles by about\n  2.3%. \n\nUpdate to 3.38.5:\n\n* Fix a blunder in the CLI of the 3.38.4 release\n\nUpdate to 3.38.4:\n\n* fix a byte-code problem in the Bloom filter pull-down\n  optimization added by release 3.38.0 in which an error in the\n  byte code causes the byte code engine to enter an infinite loop\n  when the pull-down optimization encounters a NULL key   \n\nUpdate to 3.38.3:\n\n* Fix a case of the query planner be overly aggressive with\n  optimizing automatic-index and Bloom-filter construction,\n  using inappropriate ON clause terms to restrict the size of the\n  automatic-index or Bloom filter, and resulting in missing rows\n  in the output.\n* Other minor patches. See the timeline for details. \n\nUpdate to 3.38.2:\n\n* Fix a problem with the Bloom filter optimization that might\n  cause an incorrect answer when doing a LEFT JOIN with a WHERE\n  clause constraint that says that one of the columns on the\n  right table of the LEFT JOIN is NULL.\n* Other minor patches.\n\n- Package the Tcl bindings here again so that we only ship one copy\nof SQLite (bsc#1195773).\n\nUpdate to 3.38.1:\n\n* Fix problems with the new Bloom filter optimization that might\n  cause some obscure queries to get an incorrect answer.\n* Fix the localtime modifier of the date and time functions so\n  that it preserves fractional seconds.\n* Fix the sqlite_offset SQL function so that it works correctly\n  even in corner cases such as when the argument is a virtual\n  column or the column of a view.\n* Fix row value IN operator constraints on virtual tables so that\n  they work correctly even if the virtual table implementation\n  relies on bytecode to filter rows that do not satisfy the\n  constraint.\n* Other minor fixes to assert() statements, test cases, and\n  documentation. See the source code timeline for details.\n\nUpdate to 3.38.0\n\n* Add the -\u003e and -\u003e\u003e operators for easier processing of JSON\n* The JSON functions are now built-ins\n* Enhancements to date and time functions\n* Rename the printf() SQL function to format() for better\n  compatibility, with alias for backwards compatibility.\n* Add the sqlite3_error_offset() interface for helping localize\n  an SQL error to a specific character in the input SQL text \n* Enhance the interface to virtual tables \n* CLI columnar output modes are enhanced to correctly handle tabs\n  and newlines embedded in text, and add options like '--wrap N',\n  '--wordwrap on', and '--quote' to the columnar output modes.\n* Query planner enhancements using a Bloom filter to speed up \n  large analytic queries, and a balanced merge tree to evaluate\n  UNION or UNION ALL compound SELECT statements that have an\n  ORDER BY clause.\n* The ALTER TABLE statement is changed to silently ignores\n  entries in the sqlite_schema table that do not parse when\n  PRAGMA writable_schema=ON\n\nUpdate to 3.37.2:\n\n* Fix a bug introduced in version 3.35.0 (2021-03-12) that can\n  cause database corruption if a SAVEPOINT is rolled back while\n  in PRAGMA temp_store=MEMORY mode, and other changes are made,\n  and then the outer transaction commits\n* Fix a long-standing problem with ON DELETE CASCADE and ON \n  UPDATE CASCADE in which a cache of the bytecode used to\n  implement the cascading change was not being reset following a\n  local DDL change\n\nUpdate to 3.37.1:\n\n* Fix a bug introduced by the UPSERT enhancements of version\n  3.35.0 that can cause incorrect byte-code to be generated for\n  some obscure but valid SQL, possibly resulting in a NULL-\n  pointer dereference.\n* Fix an OOB read that can occur in FTS5 when reading corrupt\n  database files.\n* Improved robustness of the --safe option in the CLI.\n* Other minor fixes to assert() statements and test cases. \n\nUpdated to 3.37.0:\n\n* STRICT tables provide a prescriptive style of data type\n  management, for developers who prefer that kind of thing.\n* When adding columns that contain a CHECK constraint or a\n  generated column containing a NOT NULL constraint, the\n  ALTER TABLE ADD COLUMN now checks new constraints against\n  preexisting rows in the database and will only proceed if no\n  constraints are violated.\n* Added the PRAGMA table_list statement.\n* Add the .connection command, allowing the CLI to keep multiple\n  database connections open at the same time.\n* Add the --safe command-line option that disables dot-commands\n  and SQL statements that might cause side-effects that extend\n  beyond the single database file named on the command-line.\n* CLI: Performance improvements when reading SQL statements that\n  span many lines.\n* Added the sqlite3_autovacuum_pages() interface.\n* The sqlite3_deserialize() does not and has never worked\n  for the TEMP database. That limitation is now noted in the\n  documentation.\n* The query planner now omits ORDER BY clauses on subqueries and\n  views if removing those clauses does not change the semantics\n  of the query.\n* The generate_series table-valued function extension is modified\n  so that the first parameter ('START') is now required. This is\n  done as a way to demonstrate how to write table-valued\n  functions with required parameters. The legacy behavior is\n  available using the -DZERO_ARGUMENT_GENERATE_SERIES\n  compile-time option.\n* Added new sqlite3_changes64() and sqlite3_total_changes64()\n  interfaces.\n* Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().\n* Use less memory to hold the database schema.\n* bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert\n  extension when a column has no collating sequence.\n","status":"published","published":"2022-11-02T16:02:10Z","modified":"2026-02-04T02:23:05.569299Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3307-2","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).\n- CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).\n  \n- Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).\n\nsqlite was updated to 3.39.3:\n\n* Use a statement journal on DML statement affecting two or more\n  database rows if the statement makes use of a SQL functions\n  that might abort.\n* Use a mutex to protect the PRAGMA temp_store_directory and\n  PRAGMA data_store_directory statements, even though they are\n  decremented and documented as not being threadsafe.\n\nUpdate to 3.39.2:\n\n* Fix a performance regression in the query planner associated\n  with rearranging the order of FROM clause terms in the\n  presences of a LEFT JOIN.\n* Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and\n  1345947, forum post 3607259d3c, and other minor problems\n  discovered by internal testing. [boo#1201783]\n\nUpdate to 3.39.1:\n\n* Fix an incorrect result from a query that uses a view that\n  contains a compound SELECT in which only one arm contains a\n  RIGHT JOIN and where the view is not the first FROM clause term\n  of the query that contains the view\n* Fix a long-standing problem with ALTER TABLE RENAME that can\n  only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set\n  to a very small value.\n* Fix a long-standing problem in FTS3 that can only arise when\n  compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time\n  option.\n* Fix the initial-prefix optimization for the REGEXP extension so\n  that it works correctly even if the prefix contains characters\n  that require a 3-byte UTF8 encoding.\n* Enhance the sqlite_stmt virtual table so that it buffers all of\n  its output. \n\nUpdate to 3.39.0:\n\n* Add (long overdue) support for RIGHT and FULL OUTER JOIN\n* Add new binary comparison operators IS NOT DISTINCT FROM and \n  IS DISTINCT FROM that are equivalent to IS and IS NOT, \n  respective, for compatibility with PostgreSQL and SQL standards\n* Add a new return code (value '3') from the sqlite3_vtab_distinct()\n  interface that indicates a query that has both DISTINCT and \n  ORDER BY clauses\n* Added the sqlite3_db_name() interface\n* The unix os interface resolves all symbolic links in database\n  filenames to create a canonical name for the database before\n  the file is opened\n* Defer materializing views until the materialization is actually\n  needed, thus avoiding unnecessary work if the materialization\n  turns out to never be used\n* The HAVING clause of a SELECT statement is now allowed on any\n  aggregate query, even queries that do not have a GROUP BY\n  clause\n* Many microoptimizations collectively reduce CPU cycles by about\n  2.3%. \n\nUpdate to 3.38.5:\n\n* Fix a blunder in the CLI of the 3.38.4 release\n\nUpdate to 3.38.4:\n\n* fix a byte-code problem in the Bloom filter pull-down\n  optimization added by release 3.38.0 in which an error in the\n  byte code causes the byte code engine to enter an infinite loop\n  when the pull-down optimization encounters a NULL key   \n\nUpdate to 3.38.3:\n\n* Fix a case of the query planner be overly aggressive with\n  optimizing automatic-index and Bloom-filter construction,\n  using inappropriate ON clause terms to restrict the size of the\n  automatic-index or Bloom filter, and resulting in missing rows\n  in the output.\n* Other minor patches. See the timeline for details. \n\nUpdate to 3.38.2:\n\n* Fix a problem with the Bloom filter optimization that might\n  cause an incorrect answer when doing a LEFT JOIN with a WHERE\n  clause constraint that says that one of the columns on the\n  right table of the LEFT JOIN is NULL.\n* Other minor patches.\n\n- Package the Tcl bindings here again so that we only ship one copy\nof SQLite (bsc#1195773).\n\nUpdate to 3.38.1:\n\n* Fix problems with the new Bloom filter optimization that might\n  cause some obscure queries to get an incorrect answer.\n* Fix the localtime modifier of the date and time functions so\n  that it preserves fractional seconds.\n* Fix the sqlite_offset SQL function so that it works correctly\n  even in corner cases such as when the argument is a virtual\n  column or the column of a view.\n* Fix row value IN operator constraints on virtual tables so that\n  they work correctly even if the virtual table implementation\n  relies on bytecode to filter rows that do not satisfy the\n  constraint.\n* Other minor fixes to assert() statements, test cases, and\n  documentation. See the source code timeline for details.\n\nUpdate to 3.38.0\n\n* Add the -\u003e and -\u003e\u003e operators for easier processing of JSON\n* The JSON functions are now built-ins\n* Enhancements to date and time functions\n* Rename the printf() SQL function to format() for better\n  compatibility, with alias for backwards compatibility.\n* Add the sqlite3_error_offset() interface for helping localize\n  an SQL error to a specific character in the input SQL text \n* Enhance the interface to virtual tables \n* CLI columnar output modes are enhanced to correctly handle tabs\n  and newlines embedded in text, and add options like '--wrap N',\n  '--wordwrap on', and '--quote' to the columnar output modes.\n* Query planner enhancements using a Bloom filter to speed up \n  large analytic queries, and a balanced merge tree to evaluate\n  UNION or UNION ALL compound SELECT statements that have an\n  ORDER BY clause.\n* The ALTER TABLE statement is changed to silently ignores\n  entries in the sqlite_schema table that do not parse when\n  PRAGMA writable_schema=ON\n\nUpdate to 3.37.2:\n\n* Fix a bug introduced in version 3.35.0 (2021-03-12) that can\n  cause database corruption if a SAVEPOINT is rolled back while\n  in PRAGMA temp_store=MEMORY mode, and other changes are made,\n  and then the outer transaction commits\n* Fix a long-standing problem with ON DELETE CASCADE and ON \n  UPDATE CASCADE in which a cache of the bytecode used to\n  implement the cascading change was not being reset following a\n  local DDL change\n\nUpdate to 3.37.1:\n\n* Fix a bug introduced by the UPSERT enhancements of version\n  3.35.0 that can cause incorrect byte-code to be generated for\n  some obscure but valid SQL, possibly resulting in a NULL-\n  pointer dereference.\n* Fix an OOB read that can occur in FTS5 when reading corrupt\n  database files.\n* Improved robustness of the --safe option in the CLI.\n* Other minor fixes to assert() statements and test cases. \n\nUpdated to 3.37.0:\n\n* STRICT tables provide a prescriptive style of data type\n  management, for developers who prefer that kind of thing.\n* When adding columns that contain a CHECK constraint or a\n  generated column containing a NOT NULL constraint, the\n  ALTER TABLE ADD COLUMN now checks new constraints against\n  preexisting rows in the database and will only proceed if no\n  constraints are violated.\n* Added the PRAGMA table_list statement.\n* Add the .connection command, allowing the CLI to keep multiple\n  database connections open at the same time.\n* Add the --safe command-line option that disables dot-commands\n  and SQL statements that might cause side-effects that extend\n  beyond the single database file named on the command-line.\n* CLI: Performance improvements when reading SQL statements that\n  span many lines.\n* Added the sqlite3_autovacuum_pages() interface.\n* The sqlite3_deserialize() does not and has never worked\n  for the TEMP database. That limitation is now noted in the\n  documentation.\n* The query planner now omits ORDER BY clauses on subqueries and\n  views if removing those clauses does not change the semantics\n  of the query.\n* The generate_series table-valued function extension is modified\n  so that the first parameter ('START') is now required. This is\n  done as a way to demonstrate how to write table-valued\n  functions with required parameters. The legacy behavior is\n  available using the -DZERO_ARGUMENT_GENERATE_SERIES\n  compile-time option.\n* Added new sqlite3_changes64() and sqlite3_total_changes64()\n  interfaces.\n* Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().\n* Use less memory to hold the database schema.\n* bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert\n  extension when a column has no collating sequence.\n","status":"published","published":"2022-11-02T16:03:48Z","modified":"2026-02-04T03:47:12.792895Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3401-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).\n- CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).\n  \n- Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).\n\nsqlite3 was update to 3.39.3:\n\n* Use a statement journal on DML statement affecting two or more\n  database rows if the statement makes use of a SQL functions\n  that might abort.\n* Use a mutex to protect the PRAGMA temp_store_directory and\n  PRAGMA data_store_directory statements, even though they are\n  decremented and documented as not being threadsafe.\n\nUpdate to 3.39.2:\n\n* Fix a performance regression in the query planner associated\n  with rearranging the order of FROM clause terms in the\n  presences of a LEFT JOIN.\n* Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and\n  1345947, forum post 3607259d3c, and other minor problems\n  discovered by internal testing. [boo#1201783]\n\nUpdate to 3.39.1:\n\n* Fix an incorrect result from a query that uses a view that\n  contains a compound SELECT in which only one arm contains a\n  RIGHT JOIN and where the view is not the first FROM clause term\n  of the query that contains the view\n* Fix a long-standing problem with ALTER TABLE RENAME that can\n  only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set\n  to a very small value.\n* Fix a long-standing problem in FTS3 that can only arise when\n  compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time\n  option.\n* Fix the initial-prefix optimization for the REGEXP extension so\n  that it works correctly even if the prefix contains characters\n  that require a 3-byte UTF8 encoding.\n* Enhance the sqlite_stmt virtual table so that it buffers all of\n  its output. \n\nUpdate to 3.39.0:\n\n* Add (long overdue) support for RIGHT and FULL OUTER JOIN\n* Add new binary comparison operators IS NOT DISTINCT FROM and \n  IS DISTINCT FROM that are equivalent to IS and IS NOT, \n  respective, for compatibility with PostgreSQL and SQL standards\n* Add a new return code (value '3') from the sqlite3_vtab_distinct()\n  interface that indicates a query that has both DISTINCT and \n  ORDER BY clauses\n* Added the sqlite3_db_name() interface\n* The unix os interface resolves all symbolic links in database\n  filenames to create a canonical name for the database before\n  the file is opened\n* Defer materializing views until the materialization is actually\n  needed, thus avoiding unnecessary work if the materialization\n  turns out to never be used\n* The HAVING clause of a SELECT statement is now allowed on any\n  aggregate query, even queries that do not have a GROUP BY\n  clause\n* Many microoptimizations collectively reduce CPU cycles by about\n  2.3%. \n\nUpdate to 3.38.5:\n\n* Fix a blunder in the CLI of the 3.38.4 release\n\nUpdate to 3.38.4:\n\n* fix a byte-code problem in the Bloom filter pull-down\n  optimization added by release 3.38.0 in which an error in the\n  byte code causes the byte code engine to enter an infinite loop\n  when the pull-down optimization encounters a NULL key   \n\nUpdate to 3.38.3:\n\n* Fix a case of the query planner be overly aggressive with\n  optimizing automatic-index and Bloom-filter construction,\n  using inappropriate ON clause terms to restrict the size of the\n  automatic-index or Bloom filter, and resulting in missing rows\n  in the output.\n* Other minor patches. See the timeline for details. \n\nUpdate to 3.38.2:\n\n* Fix a problem with the Bloom filter optimization that might\n  cause an incorrect answer when doing a LEFT JOIN with a WHERE\n  clause constraint that says that one of the columns on the\n  right table of the LEFT JOIN is NULL.\n* Other minor patches.\n\n- Package the Tcl bindings here again so that we only ship one copy\nof SQLite (bsc#1195773).\n\nUpdate to 3.38.1:\n\n* Fix problems with the new Bloom filter optimization that might\n  cause some obscure queries to get an incorrect answer.\n* Fix the localtime modifier of the date and time functions so\n  that it preserves fractional seconds.\n* Fix the sqlite_offset SQL function so that it works correctly\n  even in corner cases such as when the argument is a virtual\n  column or the column of a view.\n* Fix row value IN operator constraints on virtual tables so that\n  they work correctly even if the virtual table implementation\n  relies on bytecode to filter rows that do not satisfy the\n  constraint.\n* Other minor fixes to assert() statements, test cases, and\n  documentation. See the source code timeline for details.\n\nUpdate to 3.38.0\n\n* Add the -\u003e and -\u003e\u003e operators for easier processing of JSON\n* The JSON functions are now built-ins\n* Enhancements to date and time functions\n* Rename the printf() SQL function to format() for better\n  compatibility, with alias for backwards compatibility.\n* Add the sqlite3_error_offset() interface for helping localize\n  an SQL error to a specific character in the input SQL text \n* Enhance the interface to virtual tables \n* CLI columnar output modes are enhanced to correctly handle tabs\n  and newlines embedded in text, and add options like '--wrap N',\n  '--wordwrap on', and '--quote' to the columnar output modes.\n* Query planner enhancements using a Bloom filter to speed up \n  large analytic queries, and a balanced merge tree to evaluate\n  UNION or UNION ALL compound SELECT statements that have an\n  ORDER BY clause.\n* The ALTER TABLE statement is changed to silently ignores\n  entries in the sqlite_schema table that do not parse when\n  PRAGMA writable_schema=ON\n\nUpdate to 3.37.2:\n\n* Fix a bug introduced in version 3.35.0 (2021-03-12) that can\n  cause database corruption if a SAVEPOINT is rolled back while\n  in PRAGMA temp_store=MEMORY mode, and other changes are made,\n  and then the outer transaction commits\n* Fix a long-standing problem with ON DELETE CASCADE and ON \n  UPDATE CASCADE in which a cache of the bytecode used to\n  implement the cascading change was not being reset following a\n  local DDL change\n\nUpdate to 3.37.1:\n\n* Fix a bug introduced by the UPSERT enhancements of version\n  3.35.0 that can cause incorrect byte-code to be generated for\n  some obscure but valid SQL, possibly resulting in a NULL-\n  pointer dereference.\n* Fix an OOB read that can occur in FTS5 when reading corrupt\n  database files.\n* Improved robustness of the --safe option in the CLI.\n* Other minor fixes to assert() statements and test cases. \n\nUpdate to 3.37.0:\n\n* STRICT tables provide a prescriptive style of data type\n  management, for developers who prefer that kind of thing.\n* When adding columns that contain a CHECK constraint or a\n  generated column containing a NOT NULL constraint, the\n  ALTER TABLE ADD COLUMN now checks new constraints against\n  preexisting rows in the database and will only proceed if no\n  constraints are violated.\n* Added the PRAGMA table_list statement.\n* Add the .connection command, allowing the CLI to keep multiple\n  database connections open at the same time.\n* Add the --safe command-line option that disables dot-commands\n  and SQL statements that might cause side-effects that extend\n  beyond the single database file named on the command-line.\n* CLI: Performance improvements when reading SQL statements that\n  span many lines.\n* Added the sqlite3_autovacuum_pages() interface.\n* The sqlite3_deserialize() does not and has never worked\n  for the TEMP database. That limitation is now noted in the\n  documentation.\n* The query planner now omits ORDER BY clauses on subqueries and\n  views if removing those clauses does not change the semantics\n  of the query.\n* The generate_series table-valued function extension is modified\n  so that the first parameter ('START') is now required. This is\n  done as a way to demonstrate how to write table-valued\n  functions with required parameters. The legacy behavior is\n  available using the -DZERO_ARGUMENT_GENERATE_SERIES\n  compile-time option.\n* Added new sqlite3_changes64() and sqlite3_total_changes64()\n  interfaces.\n* Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().\n* Use less memory to hold the database schema.\n* bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert\n  extension when a column has no collating sequence.\n","status":"published","published":"2022-09-26T15:19:04Z","modified":"2026-02-04T04:29:18.520577Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5712-1","title":"sqlite3 vulnerability","description":"It was discovered that SQLite did not properly handle large string\ninputs in certain circumstances. An attacker could possibly use this\nissue to cause a denial of service or arbitrary code execution.\n","status":"published","published":"2022-11-03T13:06:06Z","modified":"2026-06-25T13:31:31.768933382Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5716-1","title":"sqlite3 vulnerability","description":"It was discovered that SQLite incorrectly handled certain long string\narguments. An attacker could use this issue to cause SQLite to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2022-11-07T17:04:34Z","modified":"2026-04-27T16:24:33.461055Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5716-2","title":"sqlite3 vulnerability","description":"USN-5716-1 fixed a vulnerability in SQLite. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that SQLite incorrectly handled certain long string\n arguments. An attacker could use this issue to cause SQLite to crash,\n resulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2022-11-21T19:07:35Z","modified":"2026-06-29T13:49:42.861383017Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}