CVE-2025-29088
published 2025-04-10CVE-2025-29088: In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
9.2th percentile
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sqlite3 | < sqlite3 3.46.1-4 (forky) | sqlite3 3.46.1-4 (forky) |
| ghost | sqlite3 | >= 0 < 3.46.1-4 | 3.46.1-4 |
| ghost | sqlite3 | >= 0 < 3.46.1-4 | 3.46.1-4 |
| ghost | sqlite3 | >= 0 < 3.31.1-4ubuntu0.7 | 3.31.1-4ubuntu0.7 |
| ghost | sqlite3 | >= 0 < 3.37.2-2ubuntu0.4 | 3.37.2-2ubuntu0.4 |
| ghost | sqlite3 | >= 0 < 3.45.1-1ubuntu2.3 | 3.45.1-1ubuntu2.3 |
| ghost | sqlite3 | >= 0 < 3.8.2-1ubuntu2.2+esm5 | 3.8.2-1ubuntu2.2+esm5 |
| ghost | sqlite3 | >= 0 < 3.11.0-1ubuntu1.5+esm3 | 3.11.0-1ubuntu1.5+esm3 |
| ghost | sqlite3 | >= 0 < 3.22.0-1ubuntu0.7+esm2 | 3.22.0-1ubuntu0.7+esm2 |
| ghost | sqlite3 | >= 0 < 3.31.1-4ubuntu0.7+esm1 | 3.31.1-4ubuntu0.7+esm1 |
| sqlite | sqlite | — | — |
| sqlite | sqlite | >= 3.49.0 < 3.49.1 | 3.49.1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian5.6LOW
vendor_redhat5.6MEDIUM
vendor_ubuntu5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens RUGGEDCOM CROSSBOW Station Access Controller
cisa_ics·2025-08-14·CVSS 9.8
[CRITICAL] Siemens RUGGEDCOM CROSSBOW Station Access Controller
ICS Advisory
##
Siemens RUGGEDCOM CROSSBOW Station Access Controller
Release DateAugust 14, 2025
Alert CodeICSA-25-226-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 6.9
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM CROSSBOW Station Access Controller (SAC)
- Vulnerabilities: Heap-Based Buffer Overflow, Integer
Ubuntu
SQLite vulnerabilities
vendor_ubuntu·2025-07-29·CVSS 5.6
CVE-2025-29088 [MEDIUM] SQLite vulnerabilities
Title: SQLite vulnerabilities
Summary: Several security issues were fixed in SQLite.
It was discovered that SQLite incorrectly handled aggregate terms. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2025-6965)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This update fixes the issue in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
and
Ubuntu 18.04 LTS. This issue was previously fixed in Ubuntu 20.04 LTS via
USN-7528-1. (CVE-2025-29088)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
SQLite vulnerabilities
vendor_ubuntu·2025-05-22·CVSS 3.2
CVE-2025-29088 [LOW] SQLite vulnerabilities
Title: SQLite vulnerabilities
Summary: Several security issues were fixed in SQLite.
It was discovered that SQLite incorrectly handled the concat_ws() function.
An attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-29087,
CVE-2025-3277)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-29088)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
sqlite: Denial of Service in SQLite
vendor_redhat·2025-04-10·CVSS 5.6
CVE-2025-29088 [MEDIUM] CWE-190 sqlite: Denial of Service in SQLite
sqlite: Denial of Service in SQLite
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
A flaw was found in SQLite. This vulnerability allows an application-level denial of service via improper configuration of the lookaside memory allocator, which could lead to resource exhaustion or application crashes.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: sqlite (Red Hat
Debian
CVE-2025-29088: sqlite3 - In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in...
vendor_debian·2025·CVSS 5.6
CVE-2025-29088 [MEDIUM] CVE-2025-29088: sqlite3 - In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in...
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 3.46.1-4)
sid: resolved (fixed in 3.46.1-4)
trixie: resolved (fixed in 3.46.1-4)
OSV
sqlite3 vulnerabilities
osv·2025-07-29·CVSS 5.5
CVE-2025-6965 [MEDIUM] sqlite3 vulnerabilities
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled aggregate terms. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2025-6965)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This update fixes the issue in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. This issue was previously fixed in Ubuntu 20.04 LTS via
USN-7528-1. (CVE-2025-29088)
OSV
sqlite3 vulnerabilities
osv·2025-05-22·CVSS 7.5
CVE-2025-29087 [HIGH] sqlite3 vulnerabilities
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled the concat_ws() function.
An attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-29087,
CVE-2025-3277)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-29088)
OSV
CVE-2025-29088: In SQLite 3
osv·2025-04-10·CVSS 5.5
CVE-2025-29088 [MEDIUM] CVE-2025-29088: In SQLite 3
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
GHSA
GHSA-mj4r-rr6h-q62g: An issue in sqlite v
ghsa_unreviewed·2025-04-10
CVE-2025-29088 [HIGH] CWE-190 GHSA-mj4r-rr6h-q62g: An issue in sqlite v
An issue in sqlite v.3.49.0 allows an attacker to cause a denial of service via the SQLITE_DBCONFIG_LOOKASIDE component
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-10
Published