{"id":"CVE-2025-70873","aliases":["AZL-83006","BELL-CVE-2025-70873","BIT-sqlite-2025-70873","DEBIAN-CVE-2025-70873","EUVD-2025-208623","GHSA-p36r-6g67-869c","MGASA-2026-0195","OESA-2026-1767","OESA-2026-1768","OESA-2026-1769","OESA-2026-1770","OESA-2026-1771","OESA-2026-1772","RHSA-2026:7656","ROOT-OS-ALPINE-318-CVE-2025-70873","ROOT-OS-ALPINE-319-CVE-2025-70873","ROOT-OS-ALPINE-320-CVE-2025-70873","ROOT-OS-ALPINE-321-CVE-2025-70873","ROOT-OS-ALPINE-322-CVE-2025-70873","SUSE-SU-2026:0955-1","SUSE-SU-2026:1065-1","SUSE-SU-2026:20771-1","SUSE-SU-2026:20794-1","SUSE-SU-2026:21095-1","SUSE-SU-2026:21173-1","UBUNTU-CVE-2025-70873","openSUSE-SU-2026:10406-1","openSUSE-SU-2026:20513-1"],"status":"published","title":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite...","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.005,"percentile":0.43144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-244"],"published":"2026-03-12T00:00:00Z","modified":"2026-11-05T09:15:05Z","fixes":[{"ecosystem":"Azure Linux:3","package":"sqlite","fixed_in":["3.44.0-3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"sqlite","fixed_in":["3.51.1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"sqlite3","fixed_in":["3.40.1-1.8.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"sqlite","fixed_in":["3.42.0-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"sqlite","fixed_in":["3.42.0-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"sqlite","fixed_in":["3.42.0-5.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"sqlite","fixed_in":["3.42.0-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite-analyzer","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite-debug","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite-devel","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite-doc","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite-libs","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite-tcl","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"sqlite-tools","fixed_in":["0:3.52.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"sqlite","fixed_in":["3.41.2-r30077","3.41.2-r40078"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-sqlite","fixed_in":["3.41.2-r30077","3.41.2-r40078"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"sqlite","fixed_in":["3.44.2-r10072","3.44.2-r20073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"rootio-sqlite","fixed_in":["3.44.2-r10072","3.44.2-r20073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"sqlite","fixed_in":["3.45.3-r30071","3.45.3-r30072"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-sqlite","fixed_in":["3.45.3-r30071","3.45.3-r30072"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"sqlite","fixed_in":["3.48.0-r40071","3.48.0-r40072","3.48.0-r40074","3.48.0-r40075","3.48.0-r40073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-sqlite","fixed_in":["3.48.0-r40071","3.48.0-r40072","3.48.0-r40074","3.48.0-r40075","3.48.0-r40073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"sqlite","fixed_in":["3.49.2-r10071","3.49.2-r10072","3.49.2-r10073","3.49.2-r10074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-sqlite","fixed_in":["3.49.2-r10071","3.49.2-r10072","3.49.2-r10073","3.49.2-r10074"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","fixed_in":["3.51.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.0-3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.51.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.1-2","3.40.1-2+deb12u1","3.40.1-2+deb12u2","3.42.0-1","3.43.0-1","3.43.1-1","3.43.2-1","3.44.0-1","3.44.2-1","3.45.0-1","3.45.1-1","3.45.2-1","3.45.3-1","3.45.3-2~exp1","3.46.0-1","3.46.1-1","3.46.1-2","3.46.1-2~exp","3.46.1-3","3.46.1-4","3.46.1-5","3.46.1-6","3.46.1-7","3.46.1-8","3.46.1-9","3.53.2-1","3.53.3-1","3.53.4-1","3.53.4-2"]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.46.1-7","3.46.1-7+deb13u1","3.46.1-7+deb13u2","3.46.1-8","3.46.1-9","3.53.2-1","3.53.3-1","3.53.4-1","3.53.4-2"]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.46.1-7","3.46.1-8","3.46.1-9","3.53.2-1","3.53.3-1","3.53.4-1","3.53.4-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-1.8.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.42.0-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.42.0-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.3-8.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-8.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.42.0-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.42.0-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.52.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.2-r30077"},{"fixed":"3.41.2-r40078"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.2-r30077"},{"fixed":"3.41.2-r40078"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.2-r10072"},{"fixed":"3.44.2-r20073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"rootio-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.2-r10072"},{"fixed":"3.44.2-r20073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.3-r30071"},{"fixed":"3.45.3-r30072"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.3-r30071"},{"fixed":"3.45.3-r30072"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.48.0-r40071"},{"fixed":"3.48.0-r40072"},{"fixed":"3.48.0-r40074"},{"fixed":"3.48.0-r40075"},{"fixed":"3.48.0-r40073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.48.0-r40071"},{"fixed":"3.48.0-r40072"},{"fixed":"3.48.0-r40074"},{"fixed":"3.48.0-r40075"},{"fixed":"3.48.0-r40073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.2-r10071"},{"fixed":"3.49.2-r10072"},{"fixed":"3.49.2-r10073"},{"fixed":"3.49.2-r10074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.49.2-r10071"},{"fixed":"3.49.2-r10072"},{"fixed":"3.49.2-r10073"},{"fixed":"3.49.2-r10074"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-9.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-slfo.1.1_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"siemens","product":"ruggedcom crossbow station access controller (sac)"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"https://sqlite.org/forum/forumpost/761eac3c82","tags":["Issue Tracking","report","web","article"]},{"url":"https://sqlite.org/src/info/3d459f1fb1bd1b5e","tags":["Issue Tracking","Patch","fix","web","article"]},{"url":"https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054","tags":["Exploit","Third Party Advisory","advisory","web","article"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-765416.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70873","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p36r-6g67-869c"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-70873","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70873.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-70873","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0195.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35267","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/H7ONAPUT5SJWZW7KAOAYADR7UWPOJ74W/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32516","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1767","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1768","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6965","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1770","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1771","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1772","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7656","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-70873","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7656.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447086","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-70873","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260955-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254670","tags":["report"]},{"url":"https://bugzilla.suse.com/1259619","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7709","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261065-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620771-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620794-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621095-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248586","tags":["report"]},{"url":"https://bugzilla.suse.com/1252217","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621173-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-70873","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-03-12T00:00:00Z","modified":"2026-10-15T01:10:30.502Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-244"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-208623","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-03-12T00:00:00Z","modified":"2026-10-15T01:10:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:06.951216Z"}],"ghsa":[{"id":"GHSA-p36r-6g67-869c","title":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite...","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-03-12T21:34:50Z","modified":"2026-10-15T03:35:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-244"],"updated_at":"2026-11-02T15:13:31.944762Z"}],"nvd":[{"id":"CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-03-12T19:16:15.933Z","modified":"2026-10-15T02:18:16.173Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-244"],"updated_at":"2026-11-02T14:12:01.641503Z"}],"osv":[{"id":"BELL-CVE-2025-70873","title":"CVE-2025-70873 does not affect BellSoft software","status":"withdrawn","published":"2026-03-14T06:07:47.198639Z","modified":"2026-03-21T07:15:07.045699Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:22.77042Z"},{"id":"CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-03-12T00:00:00Z","modified":"2026-10-28T02:31:12.548384767Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-03-12T19:16:15.933Z","modified":"2026-10-15T09:47:35.976800935Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"OESA-2026-1767","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\n\nAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:43.448388263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1768","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\n\nAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:43.455101971Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1769","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\n\nThere exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.(CVE-2025-6965)\n\nAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:43.790987475Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1770","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\n\nThere exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.(CVE-2025-6965)\n\nAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:43.747629664Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1771","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\n\nAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:43.770140551Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1772","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\n\nAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)","status":"published","published":"2026-03-27T11:10:48Z","modified":"2026-08-18T01:19:43.562141636Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:7656","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:59Z","modified":"2026-10-06T10:31:19.435671151Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2025-70873","title":"CVE-2025-70873 in sqlite - Patched by Root","description":"Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:36:59Z","modified":"2026-09-29T11:15:05.68323952Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-319-CVE-2025-70873","title":"CVE-2025-70873 in sqlite - Patched by Root","description":"Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.19. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:39:37Z","modified":"2026-09-29T10:15:42.301621656Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2025-70873","title":"CVE-2025-70873 in sqlite - Patched by Root","description":"Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:33:43Z","modified":"2026-09-29T11:15:07.155146757Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2025-70873","title":"CVE-2025-70873 in sqlite - Patched by Root","description":"Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-05T08:17:46Z","modified":"2026-11-05T09:15:05.270223133Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2025-70873","title":"CVE-2025-70873 in sqlite - Patched by Root","description":"Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:28:24Z","modified":"2026-09-29T10:15:04.835371444Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"AZL-83006","title":"CVE-2025-70873 affecting package sqlite for versions less than 3.44.0-3","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-03-12T19:16:15Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"BIT-sqlite-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.","status":"published","published":"2026-04-18T08:50:04.362Z","modified":"2026-09-08T08:48:19.489326039Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"MGASA-2026-0195","title":"Updated sqlite3 packages fix bug \u0026 security vulnerability","description":"sqlite3 shipped in Mageia 9 lacks ICU support. This update brings\nsqlite3-icu to allow ICU support be loaded as an optional extension.\nThis update fixes CVE-2025-70873, an information disclosure issue. The\nzipfileInflate function in the zipfile extension in SQLite v3.51.1 and\nearlier allows attackers to obtain heap memory via supplying a crafted\nZIP file.\n","status":"published","published":"2026-06-11T16:55:52Z","modified":"2026-06-11T17:00:04.551130756Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10406-1","title":"lemon-3.51.3-1.1 on GA media","description":"These are all security issues fixed in the lemon-3.51.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-22T00:00:00Z","modified":"2026-03-23T08:15:07.210798Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20513-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to version 3.51.3:\n\nSecurity issues:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nNon security issue:\n\n- sqlite3 won't build when using --with icu (bsc#1248586).\n\nChangelog:\n\nUpdate to version 3.51.3:\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n\nUpdate to version 3.51.2:\n\n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n\nUpdate to version 3.51.1:\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n\nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n * Improved resistance to database corruption caused by an\n application breaking Posix advisory locks using close().\n","status":"published","published":"2026-04-10T18:56:55Z","modified":"2026-04-22T18:26:01.985505Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0955-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate to 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n","status":"published","published":"2026-03-23T02:34:14Z","modified":"2026-03-24T08:45:06.504005Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1065-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n","status":"published","published":"2026-03-26T10:38:26Z","modified":"2026-03-27T08:48:27.822241Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20771-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate to sqlite3 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\nUpdate to version 3.51.3:\n\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n  \nUpdate to version 3.51.2:\n \n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n  \nUpdate to version 3.51.1:\n\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n  \nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n","status":"published","published":"2026-03-23T09:46:42Z","modified":"2026-03-25T17:23:47.164397Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20794-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate to version 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\nUpdate to version 3.51.3:\n  \n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n  \nUpdate to version 3.51.2:\n \n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n  \nUpdate to version 3.51.1:\n \n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n  \nUpdate to version 3.51.0:\n \n * New macros in sqlite3.h:\n   - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n     source code is taken.\n   - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n     code check-in.\n   - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n   same as the existing json_each() and json_tree() functions\n   except that they return JSONB for the \"value\" column when the\n   \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n   amalgamation, though they are disabled by default and must be\n   activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n   and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n   - Add the -asdict flag to the eval command to have it set the\n     row data as a dict instead of an array.\n   - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n   - Increase the precision of \".timer\" to microseconds.\n   - Enhance the \"box\" and \"column\" formatting modes to deal with\n     double-wide characters.\n   - The \".imposter\" command provides read-only imposter tables\n     that work with VACUUM and do not require the --unsafe-testing\n     option.\n   - Add the --ifexists option to the CLI command-line option and\n     to the .open command.\n   - Limit columns widths set by the \".width\" command to 30,000 or\n     less, as there is not good reason to have wider columns, but\n     supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n   - Use fewer CPU cycles to commit a read transaction.\n   - Early detection of joins that return no rows due to one or\n     more of the tables containing no rows.\n   - Avoid evaluation of scalar subqueries if the result of the\n     subquery does not change the result of the overall expression.\n   - Faster window function queries when using\n     \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n   SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n   existing sqlite3_db_status() API except that it returns 64-bit\n   results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n   sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n   interface.\n * For the built-in printf() and the format() SQL function, omit\n   the leading '-' from negative floating point numbers if the '+'\n   flag is omitted and the \"#\" flag is present and all displayed\n   digits are '0'. Use '%#f' or similar to avoid outputs like\n   '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n   continue to be 32-bit but creating one's own 64-bit build is\n   now as simple as running \"make\".\n","status":"published","published":"2026-03-19T12:20:26Z","modified":"2026-03-25T17:23:50.73513Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21095-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to version 3.51.3:\n\nSecurity issues:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nNon security issue:\n\n- sqlite3 won't build when using --with icu (bsc#1248586).\n\nChangelog:\n\nUpdate to version 3.51.3:\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n\nUpdate to version 3.51.2:\n\n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n\nUpdate to version 3.51.1:\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n\nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n * Improved resistance to database corruption caused by an\n application breaking Posix advisory locks using close().\n","status":"published","published":"2026-04-10T18:50:16Z","modified":"2026-04-17T18:23:56.485886Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21173-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to version 3.51.3:\n\nSecurity issues:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nNon security issue:\n\n- sqlite3 won't build when using --with icu (bsc#1248586).\n\nChangelog:\n\nUpdate to version 3.51.3:\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n\nUpdate to version 3.51.2:\n\n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n\nUpdate to version 3.51.1:\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n\nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n * Improved resistance to database corruption caused by an\n application breaking Posix advisory locks using close().\n","status":"published","published":"2026-04-10T18:50:16Z","modified":"2026-04-22T18:25:39.841576Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"UBUNTU-CVE-2025-70873","description":"(An information disclosure issue in the zipfileInflate function in the ...)","status":"withdrawn","published":"2026-03-13T00:00:00Z","modified":"2026-03-16T07:58:53.855521Z","updated_at":"2026-11-02T16:55:55.926217Z"}]}}