Mageia alert MGASA-2020-0070 (sqlite3)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0070: Updated sqlite3 packages fix security vulnerabilities 
Date:
             
 
Thu, 30 Jan 2020 19:29:36 +0100
Message-ID:
             
 
<20200130182936.2D3869F641@duvel.mageia.org>
MGASA-2020-0070 - Updated sqlite3 packages fix security vulnerabilities

Publication date: 30 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0070.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-13734,
     CVE-2019-13750,
     CVE-2019-13751,
     CVE-2019-13752,
     CVE-2019-13753,
     CVE-2019-16168,
     CVE-2019-19242,
     CVE-2019-19244,
     CVE-2019-19880

Description:
Updated sqlite3 packages fix security vulnerabilities:

An out of bounds write flaw (CVE-2019-13734), insufficient data validation
flaw (CVE-2019-13750), uninitialized use flaw (CVE-2019-13751), and out of
bounds read flaws (CVE-2019-13752, CVE-2019-13753) in SQLite before 3.31.0.

It was discovered that SQLite incorrectly handled certain schemas. An
attacker could possibly use this issue to cause a denial of service
(CVE-2019-16168).

It was discovered that SQLite incorrectly handled certain schemas. An
attacker could possibly use this issue to mishandles some expressions
(CVE-2019-19242).

It was discovered that SQLite incorrectly handled certain queries. An
attacker could possibly use this issue to execute arbitrary code
(CVE-2019-19244).

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger
an invalid pointer dereference because constant integer values in ORDER BY
clauses of window definitions are mishandled (CVE-2019-19880).

For other changes in this update, see the referenced releaaselogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=26104
- https://www.sqlite.org/releaselog/3_29_0.html
- https://www.sqlite.org/releaselog/3_30_0.html
- https://www.sqlite.org/releaselog/3_30_1.html
- https://www.sqlite.org/releaselog/3_31_0.html
- https://www.sqlite.org/releaselog/3_31_1.html
- https://chromereleases.googleblog.com/2019/12/stable-chan...
- https://usn.ubuntu.com/4205-1/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...

SRPMS:
- 7/core/sqlite3-3.31.1-1.mga7