CVE-2025-7458
CVE-2025-7458 · SQLite integer overflow in key info allocation may lead to information disclosure.
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
CVSS 6.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
sqlite
- Versions
- ≥ 3.39.2, < 3.41.2: Affected (custom)
Update to 3.41.2
sqlite3 Debian:12
- Versions
- 3.40.1-2
- 3.40.1-2+deb12u1
- 3.40.1-2+deb12u2
- 3.42.0-1
- 3.43.0-1
- 3.43.1-1
- 3.43.2-1
- 3.44.0-1
- 3.44.2-1
- 3.45.0-1
- 3.45.1-1
- 3.45.2-1
- 3.45.3-1
- 3.45.3-2~exp1
- 3.46.0-1
- 3.46.1-1
- 3.46.1-2
- 3.46.1-2~exp
- 3.46.1-3
- 3.46.1-4
- 3.46.1-5
- 3.46.1-6
- 3.46.1-7
- 3.46.1-8
- 3.46.1-9
- 3.53.2-1
- 3.53.3-1
- 3.53.4-1
- 3.53.4-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlite3 Debian:13
- Affected ranges
- ECOSYSTEM: < 3.42.0-1
Update to 3.42.0-1
sqlite3 Debian:14
- Affected ranges
- ECOSYSTEM: < 3.42.0-1
Update to 3.42.0-1
sqlite Ubuntu:14.04:LTS
- Versions
- 2.8.17-8fakesync1
- 2.8.17-9fakesync1
- 2.8.17-10ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlite Ubuntu:16.04:LTS
- Versions
- 2.8.17-12fakesync1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlite Ubuntu:18.04:LTS
- Versions
- 2.8.17-14fakesync1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlite Ubuntu:20.04:LTS
- Versions
- 2.8.17-15fakesync1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sqlite Ubuntu:22.04:LTS
- Versions
- 2.8.17-15fakesync1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published