[gentoo-announce] [ GLSA 202007-26 ] SQLite: Multiple vulnerabilities - gentoo-announce

From:	Sam James <sam@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202007-26 ] SQLite: Multiple vulnerabilities
Date:	Mon, 27 Jul 2020 00:19:20
Message-Id:	`20961BA7-603F-4F38-A686-00839AB44CD4@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202007-26

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: SQLite: Multiple vulnerabilities

9

     Date: July 27, 2020

10

     Bugs: #716748

11

       ID: 202007-26

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in SQLite, the worst of which

19

could result in the arbitrary execution of code.

20

21

Background

22

==========

23

24

SQLite is a C library that implements an SQL database engine.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  dev-db/sqlite                < 3.32.3                  >= 3.32.3

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in SQLite. Please review

38

the CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

Please review the referenced CVE identifiers for details.

44

45

Workaround

46

==========

47

48

There is no known workaround at this time.

49

50

Resolution

51

==========

52

53

All SQLite users should upgrade to the latest version:

54

55

  # emerge --sync

56

  # emerge --ask --oneshot --verbose ">=dev-db/sqlite-3.32.3"

57

58

References

59

==========

60

61

[  1 ] CVE-2019-20218

62

       https://nvd.nist.gov/vuln/detail/CVE-2019-20218

63

[  2 ] CVE-2020-11655

64

       https://nvd.nist.gov/vuln/detail/CVE-2020-11655

65

[  3 ] CVE-2020-11656

66

       https://nvd.nist.gov/vuln/detail/CVE-2020-11656

67

[  4 ] CVE-2020-13434

68

       https://nvd.nist.gov/vuln/detail/CVE-2020-13434

69

[  5 ] CVE-2020-13435

70

       https://nvd.nist.gov/vuln/detail/CVE-2020-13435

71

[  6 ] CVE-2020-13630

72

       https://nvd.nist.gov/vuln/detail/CVE-2020-13630

73

[  7 ] CVE-2020-13631

74

       https://nvd.nist.gov/vuln/detail/CVE-2020-13631

75

[  8 ] CVE-2020-13632

76

       https://nvd.nist.gov/vuln/detail/CVE-2020-13632

77

[  9 ] CVE-2020-13871

78

       https://nvd.nist.gov/vuln/detail/CVE-2020-13871

79

[ 10 ] CVE-2020-15358

80

       https://nvd.nist.gov/vuln/detail/CVE-2020-15358

81

82

Availability

83

============

84

85

This GLSA and any updates to it are available for viewing at

86

the Gentoo Security Website:

87

88

 https://security.gentoo.org/glsa/202007-26

89

90

Concerns?

91

=========

92

93

Security is a primary focus of Gentoo Linux and ensuring the

94

confidentiality and security of our users' machines is of utmost

95

importance to us. Any security concerns should be addressed to

96

security@g.o or alternatively, you may file a bug at

97

https://bugs.gentoo.org.

98

99

License

100

=======

101

102

Copyright 2020 Gentoo Foundation, Inc; referenced text

103

belongs to its owner(s).

104

105

The contents of this document are licensed under the

106

Creative Commons - Attribution / Share Alike license.

107

108

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202007-26
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: SQLite: Multiple vulnerabilities
9	Date: July 27, 2020
10	Bugs: #716748
11	ID: 202007-26
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in SQLite, the worst of which
19	could result in the arbitrary execution of code.
20
21	Background
22	==========
23
24	SQLite is a C library that implements an SQL database engine.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 dev-db/sqlite < 3.32.3 >= 3.32.3
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in SQLite. Please review
38	the CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	Please review the referenced CVE identifiers for details.
44
45	Workaround
46	==========
47
48	There is no known workaround at this time.
49
50	Resolution
51	==========
52
53	All SQLite users should upgrade to the latest version:
54
55	# emerge --sync
56	# emerge --ask --oneshot --verbose ">=dev-db/sqlite-3.32.3"
57
58	References
59	==========
60
61	[ 1 ] CVE-2019-20218
62	https://nvd.nist.gov/vuln/detail/CVE-2019-20218
63	[ 2 ] CVE-2020-11655
64	https://nvd.nist.gov/vuln/detail/CVE-2020-11655
65	[ 3 ] CVE-2020-11656
66	https://nvd.nist.gov/vuln/detail/CVE-2020-11656
67	[ 4 ] CVE-2020-13434
68	https://nvd.nist.gov/vuln/detail/CVE-2020-13434
69	[ 5 ] CVE-2020-13435
70	https://nvd.nist.gov/vuln/detail/CVE-2020-13435
71	[ 6 ] CVE-2020-13630
72	https://nvd.nist.gov/vuln/detail/CVE-2020-13630
73	[ 7 ] CVE-2020-13631
74	https://nvd.nist.gov/vuln/detail/CVE-2020-13631
75	[ 8 ] CVE-2020-13632
76	https://nvd.nist.gov/vuln/detail/CVE-2020-13632
77	[ 9 ] CVE-2020-13871
78	https://nvd.nist.gov/vuln/detail/CVE-2020-13871
79	[ 10 ] CVE-2020-15358
80	https://nvd.nist.gov/vuln/detail/CVE-2020-15358
81
82	Availability
83	============
84
85	This GLSA and any updates to it are available for viewing at
86	the Gentoo Security Website:
87
88	https://security.gentoo.org/glsa/202007-26
89
90	Concerns?
91	=========
92
93	Security is a primary focus of Gentoo Linux and ensuring the
94	confidentiality and security of our users' machines is of utmost
95	importance to us. Any security concerns should be addressed to
96	security@g.o or alternatively, you may file a bug at
97	https://bugs.gentoo.org.
98
99	License
100	=======
101
102	Copyright 2020 Gentoo Foundation, Inc; referenced text
103	belongs to its owner(s).
104
105	The contents of this document are licensed under the
106	Creative Commons - Attribution / Share Alike license.
107
108	https://creativecommons.org/licenses/by-sa/2.5