SUSE alert openSUSE-SU-2026:21090-1 (sqlite3)
| From: | null@suse.de | |
| To: | security-announce@lists.opensuse.org | |
| Subject: | openSUSE-SU-2026:21090-1: important: Security update for sqlite3 | |
| Date: | Tue, 30 Jun 2026 09:48:18 +0200 | |
| Message-ID: | <20260630074818.2C5FCFF8C@maintenance.suse.de> | |
| Archive-link: | Article |
openSUSE security update: security update for sqlite3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21090-1 Rating: important References: * bsc#1268012 * bsc#1268013 Cross-References: * CVE-2026-11822 * CVE-2026-11824 CVSS scores: * CVE-2026-11822 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-11824 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed. Description: This update for sqlite3 fixes the following issues Update to 3.53.2: - CVE-2026-11822: memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution (bsc#1268012). - CVE-2026-11824: heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code (bsc#1268013). Changes: * Add the Query Result Formatter (QRF) library for formatting the results of SQL queries for human readability on a fixed-pitch font screen. * Enhance ALTER TABLE to permit adding and removing NOT NULL and CHECK constraints. * The REINDEX EXPRESSIONS statement rebuilds expression indexes. * The body of TEMP triggers may now modify and/or query tables in the main schema. * Enhance VACUUM INTO so that if a URI filename is used as the target and that filename has a reserve=N query parameter with N between 0 and 255, then the reserve amount for the generated database copy is set to N. * New SQL functions json_array_insert() and jsonb_array_insert(). * Renovations to the CLI. * New C-language interfaces: sqlite3_str_truncate(), sqlite3_str_free(), sqlite3_carray_bind_v2(). * Add the SQLITE_PREPARE_FROM_DDL option to sqlite3_prepare_v3(). * Added the SQLITE_UTF8_ZT constant which can be used as the encoding parameter to sqlite3_result_text64() or sqlite3_bind_text64() to indicate that the value is UTF-8 encoded and zero terminated. * The SQLITE_LIMIT_PARSER_DEPTH option is added to sqlite3_limit(). * The SQLITE_DBCONFIG_FP_DIGITS option is added to sqlite3_db_config(). * Query planner improvements. * Add new interfaces to the session extension that enable an application to add changes one at a time to the sqlite3_changegroup object. * Improvements to floating-point <-> text conversions. * Added the self-healing index feature to deal with the stale expression index problem. * Add the "-p|--port" option to sqlite3_rsync. * Add the "opfs-wl" VFS, functionally identical to the "opfs" VFS but using Web Locks for locking, which can promise fairer lock sharing than the "opfs" bespoke protocol can. "opfs-wl" requires Atomics.waitAsync(), so requires newer browsers than "opfs" does. * Fixes for problems in 3.53.0 and 3.53.1 reported by users. * See the check-in timeline for details: https://sqlite.org/src/timeline?from=version-3.53.0&t... * https://sqlite.org/releaselog/3_53_0.html Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-955=1 Package List: - openSUSE Leap 16.0: lemon-3.53.2-160000.1.1 libsqlite3-0-3.53.2-160000.1.1 libsqlite3-0-x86-64-v3-3.53.2-160000.1.1 sqlite3-3.53.2-160000.1.1 sqlite3-devel-3.53.2-160000.1.1 sqlite3-doc-3.53.2-160000.1.1 sqlite3-tcl-3.53.2-160000.1.1 References: * https://www.suse.com/security/cve/CVE-2026-11822.html * https://www.suse.com/security/cve/CVE-2026-11824.html