In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2020-11656
https://www.oracle.com/security-alerts/cpuoct2020.html
/app/radarr/bin/System.Data.SQLite.dll
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
CVE-2019-19646
https://security.netapp.com/advisory/ntap-20191223-0001/
/app/radarr/bin/System.Data.SQLite.dll
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
CVE-2017-10989
https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937
/app/radarr/bin/System.Data.SQLite.dll
Is there an existing issue for this?
Current Behavior
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. CVE-2020-11656 https://www.oracle.com/security-alerts/cpuoct2020.html /app/radarr/bin/System.Data.SQLite.dll
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. CVE-2019-19646 https://security.netapp.com/advisory/ntap-20191223-0001/ /app/radarr/bin/System.Data.SQLite.dll
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact. CVE-2017-10989 https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937 /app/radarr/bin/System.Data.SQLite.dll
Expected Behavior
N/A
Steps To Reproduce
N/A
Environment
What branch are you running?
Master
Trace Logs?
N/A
AB#2146