SB2026042948 - openEuler 20.03 LTS SP4 update for sqlite

Description

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2025-6965)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing aggregated terms. A remote attacker can pass specially crafted input to the application where the number of aggregate terms exceeds the number of columns available, trigger memory corruption and perform a denial of service (DoS) attack.

2) Use of uninitialized resource (CVE-ID: CVE-2025-70873)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in zipfileInflate() in the zipfile extension when processing a crafted ZIP file through the zipfile() functionality. A remote attacker can supply a crafted ZIP file with a forged uncompressed size to disclose sensitive information.

Only instances where the zipfile extension is enabled and used to process untrusted ZIP content are vulnerable.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1769