SB2026042951 - openEuler 24.03 LTS SP2 update for sqlite

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042951

SB2026042951 - openEuler 24.03 LTS SP2 update for sqlite

Published: April 29, 2026

Security Bulletin ID SB2026042951
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of uninitialized resource (CVE-ID: CVE-2025-70873)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in zipfileInflate() in the zipfile extension when processing a crafted ZIP file through the zipfile() functionality. A remote attacker can supply a crafted ZIP file with a forged uncompressed size to disclose sensitive information.

Only instances where the zipfile extension is enabled and used to process untrusted ZIP content are vulnerable.


Remediation

Install update from vendor's website.

References