| Description: | Summary:
The remote host is missing an update for the Debian 'sqlite' package(s) announced via the DLA-3431-1 advisory.
Vulnerability Insight:
Two vulnerabilities have been fixed in sqlite (V2) which which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact.
CVE-2016-6153
sqlite improperly implemented the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
CVE-2018-8740
Databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference,
For Debian 10 buster, these problems have been fixed in version 2.8.17-15+deb10u1.
We recommend that you upgrade your sqlite packages.
For the detailed security status of sqlite please refer to its security tracker page at: [link moved to references]
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]
Affected Software/OS:
'sqlite' package(s) on Debian 10.
Solution:
Please install the updated package(s).
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
