Mageia alert MGASA-2017-0238 (sqlite3)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2017-0238: Updated sqlite3 packages fix security vulnerability 
Date:
    	     
 
Thu, 3 Aug 2017 21:06:23 +0200
Message-ID:
    	     
 
<20170803190623.E3F719F875@duvel.mageia.org>
MGASA-2017-0238 - Updated sqlite3 packages fix security vulnerability

Publication date: 03 Aug 2017
URL: http://advisories.mageia.org/MGASA-2017-0238.html
Type: security
Affected Mageia releases: 5, 6
CVE: CVE-2017-7000,
     CVE-2017-10989

Description:
Pointer disclosure in SQLite (CVE-2017-7000).

The getNodeSize function in ext/rtree/rtree.c in SQLite mishandles undersized
RTree blobs in a crafted database, leading to a heap-based buffer over-read or
possibly unspecified other impact (CVE-2017-10989).

Note: the CVE-2017-10989 issue only affected Mageia 5.

References:
- https://bugs.mageia.org/show_bug.cgi?id=21200
- https://chromereleases.googleblog.com/2017/07/stable-chan...
-
https://lists.fedoraproject.org/archives/list/package-ann...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7000
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10989

SRPMS:
- 6/core/sqlite3-3.17.0-2.1.mga6
- 5/core/sqlite3-3.10.2-1.1.mga5