Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5502
| From | László Böszörményi (GCS) <gcs@debian.org> |
|---|---|
| Newsgroups | linux.debian.security |
| Subject | Re: "Magellan" bug in sqlite3 |
| Date | 2018-12-20 09:10 +0100 |
| Message-ID | <x71z3-3td-3@gated-at.bofh.it> (permalink) |
| References | <x5U6B-2Hk-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Mon, Dec 17, 2018 at 6:21 AM Hideki Yamane <henrich@iijmio-mail.jp> wrote: > It may be known already but https://security-tracker.debian.org/tracker/source-package/sqlite3 > doesn't contain its vulnerability information. I've sent a detailed analysis of the possible issue back then to the Security Team. A bit later I had to go off the grid, but now back on track with some public details. > Tencent Blade Team released a security advisory about "Magellan" bug > in sqlite, that was fixed in upstream 3.26.0. > See https://blade.tencent.com/magellan/index_en.html It's turned out to be an FTS3/FTS4 extension issue (that is, you are safe if you don't use it). Upstream confirmed it[1] and fix is available[2]. First fixed version is 3.25.3 but due to other security related fixes like an OOM[3] you are better upgrade to the 3.26.0 release. Only Chrome seems to be affected due to WebSQL usage. Regards, Laszlo/GCS [1] https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html [2] https://www.sqlite.org/src/info/940f2adc8541a838 [3] https://www.sqlite.org/src/info/de0781485701c138
Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
"Magellan" bug in sqlite3 Hideki Yamane <henrich@iijmio-mail.jp> - 2018-12-17 07:00 +0100
Re: "Magellan" bug in sqlite3 qmi <lista@miklos.info> - 2018-12-18 23:40 +0100
Re: "Magellan" bug in sqlite3 Hideki Yamane <henrich@iijmio-mail.jp> - 2018-12-19 08:50 +0100
Re: "Magellan" bug in sqlite3 qmi <lista@miklos.info> - 2018-12-19 19:50 +0100
Re: "Magellan" bug in sqlite3 Christoph Moench-Tegeder <cmt@burggraben.net> - 2018-12-20 00:40 +0100
Re: "Magellan" bug in sqlite3 qmi <lista@miklos.info> - 2018-12-20 22:10 +0100
Re: "Magellan" bug in sqlite3 László Böszörményi (GCS) <gcs@debian.org> - 2018-12-20 09:10 +0100
Re: "Magellan" bug in sqlite3 Hideki Yamane <henrich@iijmio-mail.jp> - 2018-12-24 20:40 +0100
csiph-web