USN-6566-1: SQLite vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• sqlite3 - C library that implements an SQL database engine

Details

It was discovered that SQLite incorrectly handled certain protection
mechanisms when using a CLI script with the --safe option, contrary to
expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)

It was discovered that SQLite incorrectly handled certain memory operations
in the sessions extension. A remote attacker could possibly use this issue
to cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• libsqlite3-0 - 3.42.0-1ubuntu0.1

Ubuntu 23.04

• libsqlite3-0 - 3.40.1-1ubuntu0.1

Ubuntu 22.04

• libsqlite3-0 - 3.37.2-2ubuntu0.3

Ubuntu 20.04

• libsqlite3-0 - 3.31.1-4ubuntu0.6

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-46908
• CVE-2023-7104

Related notices

• USN-6566-2: libsqlite3-0, libsqlite3-tcl, libsqlite3-dev, lemon, sqlite3, sqlite3-doc