CVE-2025-29087
Fixed in a distro release EPSS <1%CVSS 3.2
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Products: SQLite, Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC), Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine:v3.19 | sqlite | 3.44.2-r1 |
| Alpine:v3.20 | sqlite | 3.45.3-r2 |
| Alpine:v3.21 | sqlite | 3.48.0-r1 |
| Debian:13 | sqlite3 | 3.46.1-3 |
| Debian:14 | sqlite3 | 3.46.1-3 |
| SUSE:Enterprise Storage 7.1 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Micro 5.1 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Micro 5.2 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Micro 5.3 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Micro 5.4 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Micro 5.5 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | sqlite3 | 3.49.1-9.33.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | sqlite3 | 3.49.1-9.33.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Linux Micro 6.0 | sqlite3 | 3.49.1-1.1 |
| SUSE:Linux Micro 6.1 | sqlite3 | 3.49.1-slfo.1.1_1.1 |
| SUSE:Manager Proxy 4.3 | sqlite3 | 3.49.1-150000.3.27.1 |
| SUSE:Manager Server 4.3 | sqlite3 | 3.49.1-150000.3.27.1 |
| Ubuntu:20.04:LTS | sqlite3 | 3.31.1-4ubuntu0.7 |
| Ubuntu:22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.4 |
| Ubuntu:24.04:LTS | sqlite3 | 3.45.1-1ubuntu2.3 |
| openSUSE:Leap 15.6 | sqlite3 | 3.49.1-150000.3.27.1 |
| openSUSE:Tumbleweed | sqlite3 | 3.49.1-3.1 |