Updated sqlite3 packages fix security vulnerability

2017-08-0322:05:47

Gentoo Foundation

advisories.mageia.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.009

Percentile

83.2%

JSON

Pointer disclosure in SQLite (CVE-2017-7000). The getNodeSize function in ext/rtree/rtree.c in SQLite mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact (CVE-2017-10989). Note: the CVE-2017-10989 issue only affected Mageia 5.

OSVersionArchitecturePackageVersionFilename
Mageia5noarchsqlite3< 3.10.2-1.1sqlite3-3.10.2-1.1.mga5
Mageia6noarchsqlite3< 3.17.0-2.1sqlite3-3.17.0-2.1.mga6