Vulnerability-Lookup

ubuntu-cve-2025-6965

Vulnerability from osv_ubuntu

Published

2025-07-15 14:15

Modified

2026-06-29 11:20

Summary

Details

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

Severity

7.2 (High)


                    
                      CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green

7.7 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-6965	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-6965	REPORT
	https://ubuntu.com/security/notices/USN-7676-1	ADVISORY
	https://ubuntu.com/security/notices/USN-7679-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.8.2-1ubuntu2.2+esm5?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.2-1ubuntu2.2+esm5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.17-1ubuntu1",
        "3.8.0.2-1ubuntu1",
        "3.8.1-1ubuntu1",
        "3.8.1-1ubuntu3",
        "3.8.2-1ubuntu1",
        "3.8.2-1ubuntu2",
        "3.8.2-1ubuntu2.1",
        "3.8.2-1ubuntu2.2",
        "3.8.2-1ubuntu2.2+esm1",
        "3.8.2-1ubuntu2.2+esm2",
        "3.8.2-1ubuntu2.2+esm3",
        "3.8.2-1ubuntu2.2+esm4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.11.0-1ubuntu1.5+esm3?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.0-1ubuntu1.5+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.8.11.1-1",
        "3.9.1-2",
        "3.9.2-1",
        "3.10.0-1",
        "3.10.1-1",
        "3.10.2-1",
        "3.11.0-1ubuntu1",
        "3.11.0-1ubuntu1.1",
        "3.11.0-1ubuntu1.2",
        "3.11.0-1ubuntu1.3",
        "3.11.0-1ubuntu1.4",
        "3.11.0-1ubuntu1.5",
        "3.11.0-1ubuntu1.5+esm1",
        "3.11.0-1ubuntu1.5+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.22.0-1ubuntu0.7+esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.22.0-1ubuntu0.7+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.19.3-3",
        "3.20.1-2",
        "3.21.0-1",
        "3.22.0-1",
        "3.22.0-1ubuntu0.1",
        "3.22.0-1ubuntu0.2",
        "3.22.0-1ubuntu0.3",
        "3.22.0-1ubuntu0.4",
        "3.22.0-1ubuntu0.5",
        "3.22.0-1ubuntu0.6",
        "3.22.0-1ubuntu0.7",
        "3.22.0-1ubuntu0.7+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.31.1-4ubuntu0.7+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.31.1-4ubuntu0.7+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.29.0-2",
        "3.30.1-1",
        "3.30.1-1ubuntu1",
        "3.31.1-1ubuntu1",
        "3.31.1-3",
        "3.31.1-4",
        "3.31.1-4ubuntu0.1",
        "3.31.1-4ubuntu0.2",
        "3.31.1-4ubuntu0.3",
        "3.31.1-4ubuntu0.4",
        "3.31.1-4ubuntu0.5",
        "3.31.1-4ubuntu0.6",
        "3.31.1-4ubuntu0.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "sqlite3-tools",
            "binary_version": "3.37.2-2ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.37.2-2ubuntu0.5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.37.2-2ubuntu0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.35.5-1",
        "3.36.0-2",
        "3.37.2-2",
        "3.37.2-2ubuntu0.1",
        "3.37.2-2ubuntu0.3",
        "3.37.2-2ubuntu0.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "sqlite3-tools",
            "binary_version": "3.45.1-1ubuntu2.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.45.1-1ubuntu2.4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.45.1-1ubuntu2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.42.0-1",
        "3.44.0-1",
        "3.44.2-1",
        "3.45.0-1",
        "3.45.1-1",
        "3.45.1-1ubuntu1",
        "3.45.1-1ubuntu2",
        "3.45.1-1ubuntu2.1",
        "3.45.1-1ubuntu2.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.46.1-6ubuntu1"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.46.1-6ubuntu1"
          },
          {
            "binary_name": "libsqlite3-ext-csv",
            "binary_version": "3.46.1-6ubuntu1"
          },
          {
            "binary_name": "libsqlite3-ext-icu",
            "binary_version": "3.46.1-6ubuntu1"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.46.1-6ubuntu1"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.46.1-6ubuntu1"
          },
          {
            "binary_name": "sqlite3-tools",
            "binary_version": "3.46.1-6ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.46.1-6ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.46.1-6ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.46.1-3",
        "3.46.1-4",
        "3.46.1-6"
      ]
    }
  ],
  "aliases": [],
  "details": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.",
  "id": "UBUNTU-CVE-2025-6965",
  "modified": "2026-06-29T11:20:08Z",
  "published": "2025-07-15T14:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-6965"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7676-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7679-1"
    }
  ],
  "related": [
    "USN-7676-1",
    "USN-7679-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-6965"
  ]
}

CVE-2025-6965 (GCVE-0-2025-6965)

Vulnerability from cvelistv5 – Published: 2025-07-15 13:44 – Updated: 2026-04-29 03:55

Title

Integer Truncation on SQLite

Summary

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-197 - Numeric Truncation Error

Assigner

Google

References

9 references

URL	Tags
https://www.sqlite.org/src/info/5508b56fd24016c13…
http://seclists.org/fulldisclosure/2025/Sep/57
http://seclists.org/fulldisclosure/2025/Sep/56
http://seclists.org/fulldisclosure/2025/Sep/53
http://seclists.org/fulldisclosure/2025/Sep/58
http://seclists.org/fulldisclosure/2025/Sep/49
http://www.openwall.com/lists/oss-security/2025/09/06/1
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
SQLite	SQLite	Affected: 0 , < 3.50.2 (semver)
Siemens	RUGGEDCOM CROSSBOW Station Access Controller (SAC)	Affected: 0 , < V5.8 (custom)
Siemens	SIDIS Prime	Affected: 0 , < V4.0.800 (custom)

Date Public

2025-06-27 22:00

Credits

Vlad Stolyarov of Google's Threat Analysis Group, with assistance from Google Big Sleep

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6965",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-28T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-29T03:55:46.708Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:51.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/57"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/56"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/53"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/58"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/49"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/06/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM CROSSBOW Station Access Controller (SAC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIDIS Prime",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0.800",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T08:58:07.313Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-225816.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.sqlite.org/src",
          "defaultStatus": "unaffected",
          "packageName": "expr.c",
          "product": "SQLite",
          "programFiles": [
            "expr.c"
          ],
          "vendor": "SQLite",
          "versions": [
            {
              "lessThan": "3.50.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vlad Stolyarov of Google\u0027s Threat Analysis Group, with assistance from Google Big Sleep"
        }
      ],
      "datePublic": "2025-06-27T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above."
            }
          ],
          "value": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-679",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "GREEN",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-197",
              "description": "CWE-197: Numeric Truncation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-15T13:44:00.784Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Integer Truncation on SQLite",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-6965",
    "datePublished": "2025-07-15T13:44:00.784Z",
    "dateReserved": "2025-07-01T09:19:04.750Z",
    "dateUpdated": "2026-04-29T03:55:46.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-7676-1

Vulnerability from osv_ubuntu

Published

2025-07-28 11:56

Modified

2026-06-29 10:53

Summary

sqlite3 vulnerability

Details

It was discovered that SQLite incorrectly handled certain numbers of aggregate terms. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.

References

URL

Type

	https://ubuntu.com/security/notices/USN-7676-1	ADVISORY
	https://ubuntu.com/security/CVE-2025-6965	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-6965",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.37.2-2ubuntu0.5"
          },
          {
            "binary_name": "sqlite3-tools",
            "binary_version": "3.37.2-2ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.37.2-2ubuntu0.5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.37.2-2ubuntu0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.35.5-1",
        "3.36.0-2",
        "3.37.2-2",
        "3.37.2-2ubuntu0.1",
        "3.37.2-2ubuntu0.3",
        "3.37.2-2ubuntu0.4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-6965",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.45.1-1ubuntu2.4"
          },
          {
            "binary_name": "sqlite3-tools",
            "binary_version": "3.45.1-1ubuntu2.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.45.1-1ubuntu2.4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.45.1-1ubuntu2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.42.0-1",
        "3.44.0-1",
        "3.44.2-1",
        "3.45.0-1",
        "3.45.1-1",
        "3.45.1-1ubuntu1",
        "3.45.1-1ubuntu2",
        "3.45.1-1ubuntu2.1",
        "3.45.1-1ubuntu2.3"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that SQLite incorrectly handled certain numbers of\naggregate terms. An attacker could use this issue to cause SQLite to crash,\nresulting in a denial of service, or possibly execute arbitrary code.",
  "id": "USN-7676-1",
  "modified": "2026-06-29T10:53:39Z",
  "published": "2025-07-28T11:56:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7676-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-6965"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "sqlite3 vulnerability",
  "upstream": [
    "UBUNTU-CVE-2025-6965"
  ]
}

usn-7679-1

Vulnerability from osv_ubuntu

Published

2025-07-29 15:36

Modified

2026-06-29 10:53

Summary

sqlite3 vulnerabilities

Details

It was discovered that SQLite incorrectly handled aggregate terms. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-6965)

It was discovered that SQLite incorrectly handled certain argument values to sqlite3_db_config(). An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This update fixes the issue in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. This issue was previously fixed in Ubuntu 20.04 LTS via USN-7528-1. (CVE-2025-29088)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7679-1	ADVISORY
	https://ubuntu.com/security/CVE-2025-6965	REPORT
	https://ubuntu.com/security/CVE-2025-29088	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-6965",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-29088",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.8.2-1ubuntu2.2+esm5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.8.2-1ubuntu2.2+esm5?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.2-1ubuntu2.2+esm5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.17-1ubuntu1",
        "3.8.0.2-1ubuntu1",
        "3.8.1-1ubuntu1",
        "3.8.1-1ubuntu3",
        "3.8.2-1ubuntu1",
        "3.8.2-1ubuntu2",
        "3.8.2-1ubuntu2.1",
        "3.8.2-1ubuntu2.2",
        "3.8.2-1ubuntu2.2+esm1",
        "3.8.2-1ubuntu2.2+esm2",
        "3.8.2-1ubuntu2.2+esm3",
        "3.8.2-1ubuntu2.2+esm4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-6965",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-29088",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.11.0-1ubuntu1.5+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.11.0-1ubuntu1.5+esm3?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.0-1ubuntu1.5+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.8.11.1-1",
        "3.9.1-2",
        "3.9.2-1",
        "3.10.0-1",
        "3.10.1-1",
        "3.10.2-1",
        "3.11.0-1ubuntu1",
        "3.11.0-1ubuntu1.1",
        "3.11.0-1ubuntu1.2",
        "3.11.0-1ubuntu1.3",
        "3.11.0-1ubuntu1.4",
        "3.11.0-1ubuntu1.5",
        "3.11.0-1ubuntu1.5+esm1",
        "3.11.0-1ubuntu1.5+esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-6965",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-29088",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.22.0-1ubuntu0.7+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.22.0-1ubuntu0.7+esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.22.0-1ubuntu0.7+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.19.3-3",
        "3.20.1-2",
        "3.21.0-1",
        "3.22.0-1",
        "3.22.0-1ubuntu0.1",
        "3.22.0-1ubuntu0.2",
        "3.22.0-1ubuntu0.3",
        "3.22.0-1ubuntu0.4",
        "3.22.0-1ubuntu0.5",
        "3.22.0-1ubuntu0.6",
        "3.22.0-1ubuntu0.7",
        "3.22.0-1ubuntu0.7+esm1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-6965",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.31.1-4ubuntu0.7+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.31.1-4ubuntu0.7+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.31.1-4ubuntu0.7+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.29.0-2",
        "3.30.1-1",
        "3.30.1-1ubuntu1",
        "3.31.1-1ubuntu1",
        "3.31.1-3",
        "3.31.1-4",
        "3.31.1-4ubuntu0.1",
        "3.31.1-4ubuntu0.2",
        "3.31.1-4ubuntu0.3",
        "3.31.1-4ubuntu0.4",
        "3.31.1-4ubuntu0.5",
        "3.31.1-4ubuntu0.6",
        "3.31.1-4ubuntu0.7"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that SQLite incorrectly handled aggregate terms. An\nattacker could use this issue to cause SQLite to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2025-6965)\n\nIt was discovered that SQLite incorrectly handled certain argument values\nto sqlite3_db_config(). An attacker could use this issue to cause SQLite to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This update fixes the issue in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and\nUbuntu 18.04 LTS. This issue was previously fixed in Ubuntu 20.04 LTS via\nUSN-7528-1. (CVE-2025-29088)",
  "id": "USN-7679-1",
  "modified": "2026-06-29T10:53:39Z",
  "published": "2025-07-29T15:36:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7679-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-6965"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-29088"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "sqlite3 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2025-6965",
    "UBUNTU-CVE-2025-29088"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2025-6965

Vulnerability from osv_ubuntu

CVE-2025-6965 (GCVE-0-2025-6965)

usn-7676-1

Vulnerability from osv_ubuntu

usn-7679-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature