{"schemaVersion":3,"id":"SUSE-SU-2026:20794-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for sqlite3\n\nThis update for sqlite3 fixes the following issues:\n\nUpdate to version 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\nUpdate to version 3.51.3:\n\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n\nUpdate to version 3.51.2:\n\n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n\nUpdate to version 3.51.1:\n\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n\nUpdate to version 3.51.0:\n\n * New macros in sqlite3.h:\n   - SQLITE_SCM_BRANCH -> the name of the branch from which the\n     source code is taken.\n   - SQLITE_SCM_TAGS -> space-separated list of tags on the source\n     code check-in.\n   - SQLITE_SCM_DATETIME -> ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n   same as the existing json_each() and json_tree() functions\n   except that they return JSONB for the \"value\" column when the\n   \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n   amalgamation, though they are disabled by default and must be\n   activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n   and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n   - Add the -asdict flag to the eval command to have it set the\n     row data as a dict instead of an array.\n   - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n   - Increase the precision of \".timer\" to microseconds.\n   - Enhance the \"box\" and \"column\" formatting modes to deal with\n     double-wide characters.\n   - The \".imposter\" command provides read-only imposter tables\n     that work with VACUUM and do not require the --unsafe-testing\n     option.\n   - Add the --ifexists option to the CLI command-line option and\n     to the .open command.\n   - Limit columns widths set by the \".width\" command to 30,000 or\n     less, as there is not good reason to have wider columns, but\n     supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n   - Use fewer CPU cycles to commit a read transaction.\n   - Early detection of joins that return no rows due to one or\n     more of the tables containing no rows.\n   - Avoid evaluation of scalar subqueries if the result of the\n     subquery does not change the result of the overall expression.\n   - Faster window function queries when using\n     \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n   SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n   existing sqlite3_db_status() API except that it returns 64-bit\n   results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n   sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n   interface.\n * For the built-in printf() and the format() SQL function, omit\n   the leading '-' from negative floating point numbers if the '+'\n   flag is omitted and the \"#\" flag is present and all displayed\n   digits are '0'. Use '%#f' or similar to avoid outputs like\n   '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n   continue to be 32-bit but creating one's own 64-bit build is\n   now as simple as running \"make\".","dates":{"published":"2026-03-19T12:20:26.000Z","modified":"2026-03-25T17:23:50.735Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"sqlite3&distro=SUSE Linux Micro 6.0","name":"sqlite3","label":"sqlite3&distro=SUSE Linux Micro 6.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/sqlite3&distro=SUSE Linux Micro 6.0","purlType":"rpm","versions":[{"text":"< 3.51.3-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.51.3-1.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620794-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202620794-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1254670","label":"bugzilla.suse.com/1254670","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259619","label":"bugzilla.suse.com/1259619","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70873","label":"www.suse.com/security/cve/CVE-2025-70873","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7709","label":"www.suse.com/security/cve/CVE-2025-7709","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2025-70873","CVE-2025-7709"],"downstream":[],"duplicates":[],"related":["CVE-2025-70873","CVE-2025-7709"]},"timeline":[{"kind":"published","date":"2026-03-19T12:20:26.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-25T17:23:50.735Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T05:02:59.261Z","stale":false,"partial":false}}