{"id":"CVE-2025-3277","aliases":["ALPINE-CVE-2025-3277","ALSA-2025:4459","ALSA-2025:7433","ALSA-2025:7517","BELL-CVE-2025-3277","BIT-sqlite-2025-3277","DEBIAN-CVE-2025-3277","EUVD-2025-15064","GHSA-g2ph-wvc2-ph4v","RHSA-2025:4459","RHSA-2025:7433","RHSA-2025:7517","RLSA-2025:4459","RLSA-2025:7433","RLSA-2025:7517","ROOT-OS-ALPINE-319-CVE-2025-3277","ROOT-OS-ALPINE-320-CVE-2025-3277","SUSE-SU-2025:01455-1","SUSE-SU-2025:01456-1","SUSE-SU-2025:01456-2","SUSE-SU-2025:1455-1","SUSE-SU-2025:1456-1","UBUNTU-CVE-2025-3277","USN-7528-1"],"status":"published","title":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated...","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01252,"percentile":0.69643,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-190"],"published":"2025-04-14T16:50:48Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"qt6-qtwebengine","fixed_in":["6.8.2-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qt6-qtwebengine","fixed_in":["6.8.2-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","fixed_in":["6.8.2-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"sqlite","fixed_in":["3.48.0-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"sqlite","fixed_in":["3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"sqlite-devel","fixed_in":["3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"sqlite-libs","fixed_in":["3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"sqlite","fixed_in":["3.46.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"sqlite","fixed_in":["3.46.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"sqlite","fixed_in":["3.49.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.46.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.46.1-3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"lemon-debuginfo","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-analyzer-debuginfo","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-debuginfo","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-debugsource","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-devel","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-libs-debuginfo","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-tcl-debuginfo","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-tools-debuginfo","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-libs","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"sqlite","fixed_in":["0:3.46.1-4.el10_0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"sqlite","fixed_in":["3.44.2-r10071","3.44.2-r10072","3.44.2-r20073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"rootio-sqlite","fixed_in":["3.44.2-r10071","3.44.2-r10072","3.44.2-r20073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"sqlite","fixed_in":["3.45.3-r30071","3.45.3-r30072"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-sqlite","fixed_in":["3.45.3-r30071","3.45.3-r30072"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"sqlite3","fixed_in":["3.45.1-1ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.2-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.2-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.2-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.44.0"},{"fixed":"3.48.0-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+3983+391a1a04"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+139+09296491"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+139+09296491"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+139+09296491"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.41.1-r0"},{"fixed":"3.46.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.41.1-r0"},{"fixed":"3.46.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.44.0"},{"fixed":"3.49.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.1-3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"lemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-analyzer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-tcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+1971+0bb08ece"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+1419+1f26ef47"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31785+5534beb0"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31786+d18c719d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31785+5534beb0"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.46.1-4.el10_0"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.2-r10071"},{"fixed":"3.44.2-r10072"},{"fixed":"3.44.2-r20073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"rootio-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.2-r10071"},{"fixed":"3.44.2-r10072"},{"fixed":"3.44.2-r20073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.3-r30071"},{"fixed":"3.45.3-r30072"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.3-r30071"},{"fixed":"3.45.3-r30072"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-9.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-9.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.1-150000.3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.1-1ubuntu2.3"}]}],"versions":["3.42.0-1","3.44.0-1","3.44.2-1","3.45.0-1","3.45.1-1","3.45.1-1ubuntu1","3.45.1-1ubuntu2","3.45.1-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.1-4ubuntu0.7"}]}],"versions":["3.29.0-2","3.30.1-1","3.30.1-1ubuntu1","3.31.1-1ubuntu1","3.31.1-3","3.31.1-4","3.31.1-4ubuntu0.1","3.31.1-4ubuntu0.2","3.31.1-4ubuntu0.3","3.31.1-4ubuntu0.4","3.31.1-4ubuntu0.5","3.31.1-4ubuntu0.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-2ubuntu0.4"}]}],"versions":["3.35.5-1","3.36.0-2","3.37.2-2","3.37.2-2ubuntu0.1","3.37.2-2ubuntu0.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.1-1ubuntu2.3"}]}],"versions":["3.42.0-1","3.44.0-1","3.44.2-1","3.45.0-1","3.45.1-1","3.45.1-1ubuntu1","3.45.1-1ubuntu2","3.45.1-1ubuntu2.1"],"bundled":3}],"products":[{"vendor":"siemens","product":"ruggedcom crossbow station access controller (sac)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"https://sqlite.org/src/info/498e3f1cf57f164f","tags":["Patch","fix","web","article"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-994087.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3277","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g2ph-wvc2-ph4v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-3277","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4459","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-31498","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-3277","tags":["report"]},{"url":"https://bugzilla.redhat.com/2358271","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359553","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-4459.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7433","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7433.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7517","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7517.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-3277","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3277.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-3277","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2358271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359553","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-78761","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-88883","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4459.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-3277","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-31498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31498","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/commit/29d38719112639d8c0ba910254a3dd4f482ea2d1","tags":["article"]},{"url":"https://github.com/c-ares/c-ares/pull/821","tags":["article"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-6hxc-62jh-p29v","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7433.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7517.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:4459","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7433","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7517","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501455-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241020","tags":["report"]},{"url":"https://bugzilla.suse.com/1241078","tags":["report"]},{"url":"https://bugzilla.suse.com/1241189","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3277","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501456-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501456-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251455-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251456-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-3277","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7528-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-29087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-29088","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-3277","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T16:50:48.902Z","modified":"2026-10-15T01:02:02.335Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:39.378527Z"}],"euvd":[{"id":"EUVD-2025-15064","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T16:50:48Z","modified":"2026-10-15T01:02:02Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"updated_at":"2026-11-02T17:27:08.661475Z"}],"ghsa":[{"id":"GHSA-g2ph-wvc2-ph4v","title":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated...","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T18:31:49Z","modified":"2026-10-15T03:35:49Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T15:13:33.329835Z"}],"nvd":[{"id":"CVE-2025-3277","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T17:15:27.297Z","modified":"2026-10-15T02:18:04.643Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T14:11:00.456643Z"}],"osv":[{"id":"ALPINE-CVE-2025-3277","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T17:15:27.297Z","modified":"2026-11-03T06:33:00.435748871Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2025-3277","status":"published","published":"2025-04-15T05:58:23.358328Z","modified":"2026-01-26T09:39:07.848968Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:21.741325Z"},{"id":"CVE-2025-3277","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T16:50:48.902Z","modified":"2026-10-28T02:30:38.590672837Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"DEBIAN-CVE-2025-3277","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T17:15:27.297Z","modified":"2026-10-15T09:47:29.826044619Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"RHSA-2025:4459","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-05-06T10:03:56Z","modified":"2026-09-09T10:06:27Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7433","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-05-14T10:06:25Z","modified":"2026-09-09T10:06:36Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7517","title":"Red Hat Security Advisory: sqlite security update","status":"published","published":"2025-05-14T10:06:48Z","modified":"2026-09-02T10:07:48Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:4459","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\n* SQLite: integer overflow in SQLite (CVE-2025-3277)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:06.677557Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7433","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\n* SQLite: integer overflow in SQLite (CVE-2025-3277)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-07-29T14:33:26.426128Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7517","title":"Important: sqlite security update","description":"SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.\n\nSecurity Fix(es):\n\n* SQLite: integer overflow in SQLite (CVE-2025-3277)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:39.394858Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-OS-ALPINE-319-CVE-2025-3277","title":"CVE-2025-3277 in sqlite - Patched by Root","description":"Root has patched CVE-2025-3277 in the sqlite package for Root:Alpine:3.19. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:39:37Z","modified":"2026-09-29T10:15:16.222344932Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2025-3277","title":"CVE-2025-3277 in sqlite - Patched by Root","description":"Root has patched CVE-2025-3277 in the sqlite package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:33:43Z","modified":"2026-09-29T11:15:04.979838014Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2025-3277","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-14T17:15:00Z","modified":"2026-04-22T15:43:48.899338Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"ALSA-2025:4459","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n  * SQLite: integer overflow in SQLite (CVE-2025-3277)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-05T00:00:00Z","modified":"2026-10-29T11:02:22.984295206Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7433","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n  * SQLite: integer overflow in SQLite (CVE-2025-3277)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:16.624042747Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7517","title":"Important: sqlite security update","description":"SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.  \n\nSecurity Fix(es):  \n\n  * SQLite: integer overflow in SQLite (CVE-2025-3277)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:15.431846Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"BIT-sqlite-2025-3277","description":"An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.","status":"published","published":"2025-04-16T07:42:43.65Z","modified":"2026-09-10T16:01:46.311117471Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"SUSE-SU-2025:01455-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function (bsc#1241020)\n- CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)\n\nOther fixes:\n\n- Updated to version 3.49.1 from Factory (jsc#SLE-16032)\n","status":"published","published":"2025-06-27T12:16:18Z","modified":"2026-03-23T04:47:32.956853Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01456-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function (bsc#1241020)\n- CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)\n\nOther fixes:\n\n- Updated to version 3.49.1 from Factory (jsc#SLE-16032)\n","status":"published","published":"2025-05-31T00:59:21Z","modified":"2026-03-23T04:47:33.243549Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01456-2","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function (bsc#1241020)\n- CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)\n\nOther fixes:\n\n- Updated to version 3.49.1 from Factory (jsc#SLE-16032)\n","status":"published","published":"2025-06-27T12:17:36Z","modified":"2026-03-23T04:46:16.200568Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:1455-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function (bsc#1241020)\n- CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)\n\nOther fixes:\n\n- Updated to version 3.49.1 from Factory (jsc#SLE-16032)\n","status":"published","published":"2025-05-07T15:13:56Z","modified":"2026-02-04T03:25:25.013893Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1456-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function (bsc#1241020)\n- CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)\n\nOther fixes:\n\n- Updated to version 3.49.1 from Factory (jsc#SLE-16032)\n","status":"published","published":"2025-05-07T15:13:45Z","modified":"2026-02-04T03:34:12.62628Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7528-1","title":"sqlite3 vulnerabilities","description":"It was discovered that SQLite incorrectly handled the concat_ws() function.\nAn attacker could use this issue to cause SQLite to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-29087,\nCVE-2025-3277)\n\nIt was discovered that SQLite incorrectly handled certain argument values\nto sqlite3_db_config(). An attacker could use this issue to cause SQLite to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2025-29088)\n","status":"published","published":"2025-05-22T18:23:26Z","modified":"2026-04-27T18:17:08.906473057Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}