Most recent entries from all

4HZM000604 — ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4)

ABB is aware of public reports of vulnerabilities in a 3rd party dependency SQLite Version 3.2.4 which was delivered together with the installation package of Camera Connect Version 2.0.0.42 and below. An update is available that resolves a privately reported outdated 3rd party component with vulnerabilities in the product versions listed as affected in the advisory.

An attacker who successfully exploited any of these vulnerabilities in the 3rd party component could potentially compromise the system in different ways.

ALSA-2021:4396 — Moderate: sqlite security update

Affected: AlmaLinux:8: lemon, AlmaLinux:8: sqlite, AlmaLinux:8: sqlite-devel, AlmaLinux:8: sqlite-doc, AlmaLinux:8: sqlite-libs

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

* sqlite: out-of-bounds access due to the use of 32-bit memory allocator interfaces (CVE-2019-5827)

* sqlite: dropping of shadow tables not restricted in defensive mode (CVE-2019-13750)

* sqlite: fts3: improve detection of corrupted records (CVE-2019-13751)

* sqlite: mishandling of certain SELECT statements with non-existent VIEW can lead to DoS (CVE-2019-19603)

* sqlite: NULL pointer dereference in sqlite3ExprCodeTarget() (CVE-2020-13435)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-05112

Withdrawn: BELL-CVE-2020-13435 — CVE-2020-13435 does not affect BellSoft software

Withdrawn by the publisher.

BIT-sqlite-2020-13435

Affected: Bitnami: sqlite

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

certfr-2020-avi-747 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2020-avi-747

CLEANSTART-2026-XV28042 — Security fix for CVE-2020-13435 applied in: sqlite 3.32.1-r0

Affected: CleanStart: sqlite

Security vulnerability affects the sqlite package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2020-31672

EUVD-2026-41751

fkie_cve-2020-13435

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

GHSA-4hxf-56qj-qrgf

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

gsd-2020-13435

ICSA-23-348-10 — Siemens SIMATIC S7-1500

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…

msrc_CVE-2020-13435 — SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

msrc_CVE-2020-13435

openSUSE-SU-2021:1058-1 — Security update for sqlite3

Security update for sqlite3

RHSA-2025:16504 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update

sqlite: infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements sqlite: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns sqlite: malformed window-function query leads to DoS sqlite: use-after-free in the ALTER TABLE implementation sqlite: integer overflow in sqlite3_str_vappendf function in printf.c sqlite: NULL pointer dereference in sqlite3ExprCodeTarget() sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c sqlite: Virtual table can be renamed into the name of one of its shadow tables sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query

SUSE-SU-2021:2320-1 — Security update for sqlite3

Security update for sqlite3

UBUNTU-CVE-2020-13435

Affected: Ubuntu:20.04:LTS: sqlite3

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

WID-SEC-W-2023-0856 — IBM QRadar SIEM: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.