sqlite-3.34.1-11.el9_8
エラータID: AXSA:2026-1681:03
リリース日:
2026/08/27 Thursday - 21:23
題名:
sqlite-3.34.1-11.el9_8
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- SQLite の FTS5 拡張機能には、メモリ領域の範囲外読み取りの問題
があるため、ローカルの攻撃者により、情報の漏洩、データ破壊、および
サービス拒否攻撃を可能とする脆弱性が存在します。(CVE-2026-11822)
- SQLite の FTS5 拡張機能には、整数アンダーフローの問題があるため、
ローカルの攻撃者により、情報の漏洩、データ破壊、およびサービス拒否
攻撃を可能とする脆弱性が存在します。(CVE-2026-11824)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-11822
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
CVE-2026-11824
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
追加情報:
N/A
ダウンロード:
SRPMS
- sqlite-3.34.1-11.el9_8.src.rpm
MD5: 8a654c10f23ca2f17926c2e46cd0fe86
SHA-256: 2e5e97a346e58fa5e533c83a4ad6ad538495d37c2e31d082d4683ba07a8988cc
Size: 23.95 MB
Asianux Server 9 for x86_64
- sqlite-3.34.1-11.el9_8.i686.rpm
MD5: b0384e0bd058c193cd16d835e4165f41
SHA-256: f5dcd78e5a52b2e341e988ec0a88ee8a0f87cbdbf9ed4f15c5bc7b8280a8fbe4
Size: 806.32 kB - sqlite-3.34.1-11.el9_8.x86_64.rpm
MD5: 647ebb03cf14e700f4865fedfb4ada8d
SHA-256: 1f306a5fc68f56fd7c2d1f0ecf29c36156053be7fd1ad19956638988dd75c0cf
Size: 758.10 kB - sqlite-devel-3.34.1-11.el9_8.i686.rpm
MD5: 55dc92e7e5e72cd0e23c5eb62006520f
SHA-256: 3fb95efb712d46e234bd0ebd77e97a6a6121c95aca7ddcd7923fc75845d98bdc
Size: 133.38 kB - sqlite-devel-3.34.1-11.el9_8.x86_64.rpm
MD5: 5aa7f7a86e97c3d66e9332eeaa5f0222
SHA-256: 4ae9f1783cf49d053a428e8fbfdf7094b227ad18c7eb7e5afbf24deab0fd9fb7
Size: 133.37 kB - sqlite-libs-3.34.1-11.el9_8.i686.rpm
MD5: 8f995c9b2d9f250670660c241f6c25db
SHA-256: 8b9f632f6f34bf761303b80e4d1187382a41b2efffbd5107e69713279a1cf21b
Size: 690.49 kB - sqlite-libs-3.34.1-11.el9_8.x86_64.rpm
MD5: 2360eba9e272c56d07da4759295d39d1
SHA-256: 0b3e9b112d605ec6cd57fe67566062c2520410750b57641fcf0b517cd7e6dcfd
Size: 643.33 kB
English