change the libtool version to use from 1.3 to 1.5845bb504da
sqlite -- integer overflowentered 2025-04-30
Port details
databases/sqlite22.8.17_5
SQL database engine in a C library
- Maintainer
- ports@FreeBSD.org
- Packages
- sqlite 2.8.17_5
- Upstream
- up to date
- CPE
sqlite:sqlitefrom the port- WWW
- https://www.sqlite.org/
- Links
- cgit · VuXML
Unaddressed (28) · The CVE record lists this version as affected, no VuXML entry names the CVE
Updating to 3.53.2 would fix 12 of 28 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 3.8.9 1 · 3.25.3 3 · 3.32.0 6 · 3.32.3 7 · 3.39.2 8 · 3.50.2 9 · 3.51.1 10 · 3.53.2 12
| CVE-2015-5895 | 10.0 | 2015-09-18 | Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. |
| CVE-2020-11656 | 9.8 | 2020-04-09 | In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. |
| CVE-2019-19646 | 9.8 | 2019-12-09 | pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. |
| CVE-2017-10989 | 9.8 | 2017-07-07 | The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, lead… |
| CVE-2026-11822 | 8.5 | 2026-06-09 | SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, … |
| CVE-2026-11824 | 8.5 | 2026-06-09 | SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitra… |
| CVE-2018-20506 | 8.1 | 2019-04-03 | SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occ… |
| CVE-2018-20346 | 8.1 | 2018-12-21 | SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted change… |
| CVE-2025-70873 | 7.5 | 2026-03-12 | An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplyin… |
| CVE-2022-35737 | 7.5 | 2022-08-03 | SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. |
| CVE-2020-11655 | 7.5 | 2020-04-09 | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initializatio… |
| CVE-2018-20505 | 7.5 | 2019-04-03 | SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the a… |
| CVE-2018-8740 | 7.5 | 2018-03-17 | In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c. |
| CVE-2015-3717 | 7.5 | 2015-07-03 | Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary cod… |
| CVE-2015-3416 | 7.5 | 2015-04-24 | The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows conte… |
| CVE-2015-3415 | 7.5 | 2015-04-24 | The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denia… |
| CVE-2015-3414 | 7.5 | 2015-04-24 | SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uniniti… |
| CVE-2025-6965 | 7.2 | 2025-07-15 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memo… |
| CVE-2020-13630 | 7.0 | 2020-05-27 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. |
| CVE-2015-6607 | 6.8 | 2015-10-06 | SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586. |
| CVE-2016-6153 | 5.9 | 2016-09-26 | os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a … |
| CVE-2023-7104 | 5.5 | 2023-12-29 | A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3ses… |
| CVE-2020-15358 | 5.5 | 2020-06-27 | In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for c… |
| CVE-2020-13632 | 5.5 | 2020-05-27 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. |
| CVE-2020-13631 | 5.5 | 2020-05-27 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. |
Show all 28
| CVE-2020-13434 | 5.5 | 2020-05-24 | SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. |
| CVE-2020-13435 | 5.5 | 2020-05-24 | SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. |
| CVE-2019-19645 | 5.5 | 2019-12-09 | alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. |
VuXML only (1) · listed, port not fixed yet
Fixed (0)
No VuXML entries for this package.
Commits (84)
At Kris's request, back out the MACHINE_ARCH spelling correction until after 5.4-RELEASE.c3d8037aeb
Assist getting more ports working on AMD64 by obeying the Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.f2fc2d60ae
Update to 2.8.16 PR: ports/78510 Submitted by: Marcus Grando58f98c6e5c
Reset maintainer on request. Thanks to Gerhard for maintaining the ports so far! PR: ports/78088c94737d606
Add dependency on devel/pkgconfig. Pointy hat to: pointyhat via kris3f5ac53011
Clean up SQLite and related ports. o Move databases/sqlite to databases/sqlite2. o Fix dependency on databases/sqlite. o Update sqlite2 to 2.8.15. o Bump PORTREVISION, accordingly. Approved by: portmgr, maintainers of sqlite and related ports617938836d
Remove partial repo-copies that were requested and performed but never completed by the original committer. They can be re-added later if anyone takes a renewed interest.7eb48b0fec
- Update to 2.8.14 PR: ports/68143 Submitted by: Rui Lopes <rui@ruilopes.com> Approved by: maintainer timeout (14 days)3ef9006cc3
Fix build error. Pointy hat to: myself Approved by: Gerhard Haering <gh@ghaering.de> (maintainer/implicitly)908d538882
Update to 2.8.13. Approved by: Gerhard Haering <gh@ghaering.de> (maintainer)4c2cd81f13
Whoa there, boy, that's a mighty big commit y'all have there...
Begin autotools sanitization sequence by requiring ports to explicitly
specify which version of {libtool,autoconf,automake} they need, erasing
the concept of a "system default".
For ports-in-waiting:
USE_LIBTOOL=YES -> USE_LIBTOOL_VER=13
USE_AUTOCONF=YES -> USE_AUTOCONF_VER=213
USE_AUTOMAKE=YES -> USE_AUTOMAKE_VER=14
Ports attempting to use the old style system after June 1st 2004 will be
sorely disappointed.3f651573adUpdate to 2.8.12. Submitted by: Paul Dlug <paul@aps.org> Approved by: Gerhard Haering <gh@ghaering.de> (maintainer)6f7f7f3ac7
Bump PORTREVISION on all ports that depend on gettext to aid with upgrading. (Part 2)053fdb6a6b
- Update to 2.8.11 PR: ports/61110 Submitted by: Phil Oleson <oz@nixil.net> Approved by: maintainerfac4a8f661
Upgrade to 2.8.6 Approved by: maintainerffa7e9deb9
libtool uber-patch * kill devel/libtool and move to devel/libtool13, upgrading to 1.3.5 * upgrade repo-copied devel/libtool14 to 1.4.3 * break out libltdl into its own separate port * move to version-numbered binaries/scripts (ie: there is *no* 'libtool' any more -- USE_LIBTOOL and USE_LIBTOOL_VER are your friends) Approved by: portmgr (kris) - for the bsd.port.mk hooks Tested by: bento 4-exp builds (repeatedly)b2fd75e438
o Update to 2.8.3. o The TCL wrapper is now optional and off by default. Use SQLITE_WITH_TCL83/SQLITE_WITH_TCL84 to enable it. TCL is still needed for building the docs, unless you specify NOPORTDOCS. o The TCL example is now installed in $LOCALBASE/share/examples/sqlite. This patch is quite hackish in that it replaces the libtool stuff from SQLite with the libtool port. It also uses plain 'install' instead of 'libtool install' to install shared libraries. This might not look nice, but it's the only way I got the desired effects to work (i. e. SQLite's libtool refused to install the TCL wrapper in $LOCALBASE/lib/sqlite - it insisted on only installing it into $LOCALBASE/lib. PR: ports/53182 Submitted by: Gerhard Haering <gh@ghaering.de> (maintainer)9c922cdda1
Update to 2.8.0. PR: ports/49107[1], ports/50095[2] Submitted by: Gerhard Haering <gh@ghaering.de> (maintainer)[1] Martin Klaffenboeck <martin.klaffenboeck@gmx.at>[2]bd3124540d
De-pkg-comment.2e4c764a61
- update tp 2.7.4 - fix style nits (spaces -> tabs) PR: 46470 Submitted by: maintainer7fcd208ede
upgrade to 2.7.3 PR: 45203 Submitted by: maintainer3340a78674
Renumber the shlib major 2 instead of 0, which was unwanted regression. While I'm here, add libtclsqlite.la to ALL_TARGET so the libtclsqlite library is properly built in the build stage instead of the install stage.7908026ee7
Fixup from previous commit Bump PORTREVISION Submitted by: maintainer7bb30f60b0
Update to 2.7.1 PR: 40816 Submitted by: maintainere5962c5b63
Fix build on -CURRENT.beaef15fde
Use versioned (1.0.32) to overcome unfetchable distfile. PR: 32413fff7cb6e02
Update to 1.0.32 and unbreak. - Complete SRCS. - Patch tableapi.test to avoid an out-of-scope error.6c96feb39d
add missing file4f5995875c
A number of things: . changed maintainership to ports@; . build with TCL support (``package require sqlite''); . run the vendor's tests after build (sorry, Maxim) -- zero errors; . generate from the TCL sources and install the HTML documentation; (unless NOPORTDOCS is set); . build and install two usefull tools, which come with the software: gdbmdump and gdbmstat; . build and install the shared version of -lsqlite -- usefull and needed for dynamic loading into TCL interpreter; . lastly: the new functionality (TCL, tools, docs) called for the PORTREVISION bump. Approved by: after the previous maintainer suggested the first point above, the rest was easy :-)55b0526ba9
upgrade to 1.0.309702318aba
upgrade to 1.0.27 PR: 2602884b2bc0185
upgrade to 1.0.2555e39f2d7f
add sqlite SQL library that uses GDBM as its underlying file storage mechanisma1d5ba5433