diff options
| author | Fernando Apesteguía <fernape@FreeBSD.org> | 2025-07-31 06:32:48 +0000 |
|---|---|---|
| committer | Fernando Apesteguía <fernape@FreeBSD.org> | 2025-07-31 06:40:27 +0000 |
| commit | 041f9ec0e5ce8ba6c3107bcb53b707d33e7f8d1e (patch) | |
| tree | 3571b75def9ae3e14821497626a01dd649d9136a | |
| parent | 925515fedcb428e94f27e7e3060991ea52d5df4f (diff) | |
security/vuxml: Add Sqlite vulnerability
CVE_ID=CVE-2025-7458
| -rw-r--r-- | security/vuxml/vuln/2025.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 20ec0e05d48c..9fca85f3b971 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,35 @@ + <vuln vid="f51077bd-6dd7-11f0-9d62-b42e991fc52e"> + <topic>SQLite -- integer overflow in key info allocation</topic> + <affects> + <package> + <name>sqlite3</name> + <range><gt>3.39.2</gt></range> + <range><lt>3.41.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>cve-coordination@google.com reports:</p> + <blockquote cite="https://sqlite.org/forum/forumpost/16ce2bb7a639e29b"> + <p>An integer overflow in the sqlite3KeyInfoFromExprList function in + SQLite versions 3.39.2 through 3.41.1 allows an attacker with the + ability to execute arbitrary SQL statements to cause a denial of + service or disclose sensitive information from process memory via + a crafted SELECT statement with a large number of expressions in + the ORDER BY clause.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2025-7458</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2025-7458</url> + </references> + <dates> + <discovery>2025-07-29</discovery> + <entry>2025-07-31</entry> + </dates> + </vuln> + <vuln vid="cd7f969e-6cb4-11f0-97c4-40b034429ecf"> <topic>p5-Crypt-CBC -- Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</topic> <affects> |