kritik
CVE-2025-3277
SQLite: integer overflow in SQLite
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta).
Açıklama
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | sqlite | 3.49.1 |
| alma 8 | nodejs:22::nodejs, nodejs:22::nodejs-devel, nodejs:22::nodejs-docs ve 7 tane daha | 1:22.15.0-1.module_el8.10.0+3986+a908e756 ve 4 tane daha |
| alma 9 | nodejs:22::nodejs, nodejs:22::nodejs-devel, nodejs:22::nodejs-docs ve 7 tane daha | 1:22.15.0-1.module_el9.6.0+164+2d89b8ed ve 4 tane daha |
| alpine 3.21 | sqlite | 3.48.0-r1 |
| alpine 3.22 | qt6-qtwebengine | 6.8.2-r4 |
| alpine 3.23 | qt6-qtwebengine | 6.8.2-r4 |
| alpine 3.24 | qt6-qtwebengine | 6.8.2-r4 |
| alpine edge | qt6-qtwebengine | 6.8.2-r4 |
| debian 13 | sqlite3 | 3.46.1-3 |
| debian 14 | sqlite3 | 3.46.1-3 |
| minimos | sqlite | 3.49.1-r0 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs ve 7 tane daha | 1:22.15.0-1.module+el8.10.0+90558+f3d29a46 ve 4 tane daha |
37 kaynaktaki 120 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | sqlite | 3.49.1 |
| alma 8 | nodejs:22::nodejs | 1:22.15.0-1.module_el8.10.0+3986+a908e756 |
| alma 8 | nodejs:22::nodejs-devel | 1:22.15.0-1.module_el8.10.0+3986+a908e756 |
| alma 8 | nodejs:22::nodejs-docs | 1:22.15.0-1.module_el8.10.0+3986+a908e756 |
| alma 8 | nodejs:22::nodejs-full-i18n | 1:22.15.0-1.module_el8.10.0+3986+a908e756 |
| alma 8 | nodejs:22::nodejs-libs | 1:22.15.0-1.module_el8.10.0+3986+a908e756 |
| alma 8 | nodejs:22::nodejs-nodemon | 3.0.1-1.module_el8.10.0+3983+391a1a04 |
| alma 8 | nodejs:22::nodejs-packaging | 2021.06-4.module_el8.10.0+3961+6a788e57 |
| alma 8 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module_el8.10.0+3961+6a788e57 |
| alma 8 | nodejs:22::npm | 1:10.9.2-1.22.15.0.1.module_el8.10.0+3986+a908e756 |
| alma 8 | nodejs:22::v8-12.4-devel | 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756 |
| alma 9 | nodejs:22::nodejs | 1:22.15.0-1.module_el9.6.0+164+2d89b8ed |
| alma 9 | nodejs:22::nodejs-devel | 1:22.15.0-1.module_el9.6.0+164+2d89b8ed |
| alma 9 | nodejs:22::nodejs-docs | 1:22.15.0-1.module_el9.6.0+164+2d89b8ed |
| alma 9 | nodejs:22::nodejs-full-i18n | 1:22.15.0-1.module_el9.6.0+164+2d89b8ed |
| alma 9 | nodejs:22::nodejs-libs | 1:22.15.0-1.module_el9.6.0+164+2d89b8ed |
| alma 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module_el9.5.0+139+09296491 |
| alma 9 | nodejs:22::nodejs-packaging | 2021.06-4.module_el9.5.0+139+09296491 |
| alma 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module_el9.5.0+139+09296491 |
| alma 9 | nodejs:22::npm | 1:10.9.2-1.22.15.0.1.module_el9.6.0+164+2d89b8ed |
| alma 9 | nodejs:22::v8-12.4-devel | 3:12.4.254.21-1.22.15.0.1.module_el9.6.0+164+2d89b8ed |
| alpine 3.21 | sqlite | 3.48.0-r1 |
| alpine 3.22 | qt6-qtwebengine | 6.8.2-r4 |
| alpine 3.23 | qt6-qtwebengine | 6.8.2-r4 |
| alpine 3.24 | qt6-qtwebengine | 6.8.2-r4 |
| alpine edge | qt6-qtwebengine | 6.8.2-r4 |
| debian 13 | sqlite3 | 3.46.1-3 |
| debian 14 | sqlite3 | 3.46.1-3 |
| minimos | sqlite | 3.49.1-r0 |
| Oracle Linux 8 | nodejs | 1:22.15.0-1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | nodejs-devel | 1:22.15.0-1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | nodejs-docs | 1:22.15.0-1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | nodejs-full-i18n | 1:22.15.0-1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | nodejs-libs | 1:22.15.0-1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | nodejs-packaging | 2021.06-4.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-4.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | npm | 1:10.9.2-1.22.15.0.1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.15.0.1.module+el8.10.0+90558+f3d29a46 |
| Oracle Linux 9 | nodejs | 1:22.15.0-1.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | nodejs-devel | 1:22.15.0-1.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | nodejs-docs | 1:22.15.0-1.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | nodejs-full-i18n | 1:22.15.0-1.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | nodejs-libs | 1:22.15.0-1.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | nodejs-packaging | 2021.06-4.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-4.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | npm | 1:10.9.2-1.22.15.0.1.module+el9.6.0+90588+1a9ecb62 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.15.0.1.module+el9.6.0+90588+1a9ecb62 |
| rapidfort alma 9 | nodejs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort alma 9 | nodejs-docs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort alma 9 | nodejs-full-i18n | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort alma 9 | nodejs-libs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort alma 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort alma 9 | npm | 1:10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9 |
| rapidfort alpine 3.20 | qt6-qtwebengine | 6.8.2-r4 |
| rapidfort alpine 3.20 | sqlite | 3.48.0-r1 |
| rapidfort alpine 3.21 | qt6-qtwebengine | 6.8.2-r4 |
| rapidfort alpine 3.21 | sqlite | 3.48.0-r1 |
| rapidfort alpine 3.22 | qt6-qtwebengine | 6.8.2-r4 |
| rapidfort alpine 3.22 | sqlite | 3.48.0-r1 |
| rapidfort alpine 3.23 | qt6-qtwebengine | 6.8.2-r4 |
| rapidfort alpine 3.23 | sqlite | 3.48.0-r1 |
| rapidfort alpine 3.24 | qt6-qtwebengine | 6.8.2-r4 |
| rapidfort alpine 3.24 | sqlite | 3.48.0-r1 |
| rapidfort debian 12 | rf-sqlite3 | 0:3.46.1-7+deb13u1 |
| rapidfort debian 12 | sqlite3 | 0:3.46.1-3 |
| rapidfort debian 13 | rf-sqlite3 | 0:3.46.1-7+deb13u1 |
| rapidfort debian 13 | sqlite3 | 0:3.46.1-3 |
| rapidfort fedora 41 | rf-sqlite | 0:3.46.1-3.fc41 |
| rapidfort fedora 41 | sqlite | 0:3.46.1-3.fc41 |
| rapidfort Oracle Linux 10 | sqlite | 0:3.46.1-4.el10_0 |
| rapidfort Oracle Linux 10 | sqlite-devel | 0:3.46.1-4.el10_0 |
| rapidfort Oracle Linux 10 | sqlite-libs | 0:3.46.1-4.el10_0 |
| rapidfort Oracle Linux 9 | nodejs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Oracle Linux 9 | npm | 1:10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Red Hat 9 | nodejs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Red Hat 9 | nodejs-docs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Red Hat 9 | nodejs-libs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort Red Hat 9 | npm | 1:10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9 |
| rapidfort rocky 9 | nodejs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort rocky 9 | nodejs-full-i18n | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort rocky 9 | nodejs-libs | 1:22.15.0-1.module+el9.6.0+23062+9e7801b9 |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| rapidfort rocky 9 | npm | 1:10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9 |
| rapidfort ubuntu 20.04 | rf-sqlite3 | 0:3.45.1-1ubuntu2.3 |
| rapidfort ubuntu 20.04 | sqlite3 | 0:3.45.1-1ubuntu2.3 |
| rapidfort ubuntu 22.04 | rf-sqlite3 | 0:3.45.1-1ubuntu2.3 |
| rapidfort ubuntu 22.04 | sqlite3 | 0:3.45.1-1ubuntu2.3 |
| rapidfort ubuntu 24.04 | rf-sqlite3 | 0:3.45.1-1ubuntu2.3 |
| rapidfort ubuntu 24.04 | sqlite3 | 0:3.45.1-1ubuntu2.3 |
| rocky 10 | sqlite | 3.46.1-4.el10_0 |
| rocky 10 | sqlite-devel | 3.46.1-4.el10_0 |
| rocky 10 | sqlite-libs | 3.46.1-4.el10_0 |
| rocky 8 | nodejs:22::nodejs | 1:22.15.0-1.module+el8.10.0+1971+0bb08ece |
| rocky 8 | nodejs:22::nodejs-devel | 1:22.15.0-1.module+el8.10.0+1971+0bb08ece |
| rocky 8 | nodejs:22::nodejs-docs | 1:22.15.0-1.module+el8.10.0+1971+0bb08ece |
| rocky 8 | nodejs:22::nodejs-full-i18n | 1:22.15.0-1.module+el8.10.0+1971+0bb08ece |
| rocky 8 | nodejs:22::nodejs-libs | 1:22.15.0-1.module+el8.10.0+1971+0bb08ece |
| rocky 8 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el8.10.0+1924+614dc87f |
| rocky 8 | nodejs:22::nodejs-packaging | 2021.06-4.module+el8.10.0+1924+614dc87f |
| rocky 8 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module+el8.10.0+1924+614dc87f |
| rocky 8 | nodejs:22::npm | 1:10.9.2-1.22.15.0.1.module+el8.10.0+1971+0bb08ece |
| rocky 8 | nodejs:22::v8-12.4-devel | 3:12.4.254.21-1.22.15.0.1.module+el8.10.0+1971+0bb08ece |
| rocky 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el9.6.0+32143+ae966e5b |
| rocky 9 | nodejs:22::nodejs-packaging | 2021.06-4.module+el9.6.0+32185+bd121a25 |
| rocky 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module+el9.6.0+32185+bd121a25 |
| root.io debian 13 | rootio-sqlite3 | 3.46.1-3 |
| seal debian | seal-sqlite3 | 3.40.1-2+sp999 |
| seal debian | sqlite3 | 3.40.1-2+sp999 |
| seal Red Hat 7 | seal-sqlite | 3.7.17-8.el7_7.1+sp999 |
| seal Red Hat 7 | sqlite | 3.7.17-8.el7_7.1+sp999 |
| ubuntu 24.04 | sqlite3 | 3.45.1-1ubuntu2.3 |
| ubuntu 24.10 | sqlite3 | 3.46.1-1ubuntu0.2 |
Referanslar
- https://access.redhat.com/errata/RHSA-2025:7433
- https://access.redhat.com/security/cve/CVE-2025-3277
- https://bugzilla.redhat.com/2358271
- https://bugzilla.redhat.com/2359553
- https://bugzilla.redhat.com/show_bug.cgi?id=2358271
- https://bugzilla.redhat.com/show_bug.cgi?id=2359553
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-994087.html
19 referansın hepsi
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31498
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3277
- https://errata.almalinux.org/9/ALSA-2025-7433.html
- https://errata.rockylinux.org/RLSA-2025:7433
- https://linux.oracle.com/cve/CVE-2025-3277.html
- https://linux.oracle.com/errata/ELSA-2025-7517.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-3277
- https://sqlite.org/src/info/498e3f1cf57f164f
- https://ubuntu.com/security/notices/USN-7528-1
- https://www.cve.org/CVERecord?id=CVE-2025-3277