MGASA-2026-0305

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0305.html
Import Source
https://advisories.mageia.org/MGASA-2026-0305.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0305
Upstream
Published
2026-07-28T07:15:48Z
Modified
2026-07-28T07:30:04.772773986Z
Summary
Updated sqlite3 packages fix security vulnerabilities
Details

CVE-2026-50812: A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changesetapplyv3() applies a corrupt changeset and reaches sqlite3valuetype() with a NULL sqlite3_value pointer.

CVE-2026-50813: An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path.

References
Credits

Affected packages

Mageia:10 / sqlite3

Package

Name
sqlite3
Purl
pkg:rpm/mageia/sqlite3?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.51.3-1.2.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0305.json"

Mageia:9 / sqlite3

Package

Name
sqlite3
Purl
pkg:rpm/mageia/sqlite3?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.40.1-1.10.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0305.json"