This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsaid="201904-21">
<title>SQLite: Remote code execution</title>
<synopsis>A vulnerability in SQLite may allow for the remote execution of
code.
</synopsis>
<producttype="ebuild">sqlite</product>
<announced>2019-04-22</announced>
<revisedcount="1">2019-04-22</revised>
<bug>672942</bug>
<access>remote</access>
<affected>
<packagename="dev-db/sqlite"auto="yes"arch="*">
<unaffectedrange="ge">3.25.3</unaffected>
<vulnerablerange="lt">3.25.3</vulnerable>
</package>
</affected>
<background>
<p>SQLite is a C library that implements an SQL database engine.</p>
</background>
<description>
<p>An integer overflow was discovered in SQLite’s FTS3 extension.</p>
</description>
<impacttype="normal">
<p>A remote attacker could, by executing arbitrary SQL statements against a
vulnerable host, execute arbitrary code.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All SQLite users should upgrade to the latest version:</p>