{"id":"MGASA-2026-0305","summary":"Updated sqlite3 packages fix security vulnerabilities","details":"CVE-2026-50812:\nA NULL pointer dereference in the SQLite Session Extension in SQLite\n3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows\nan attacker who can supply a malformed changeset blob to cause a denial\nof service. The issue occurs when sqlite3changeset_apply_v3() applies a\ncorrupt changeset and reaches sqlite3_value_type() with a NULL\nsqlite3_value pointer.\n\nCVE-2026-50813:\nAn issue in SQLite before Fossil check-in 869a51ae84df allows a local\nattacker to obtain sensitive information via the Session Extension\nchangeset concat/changegroup merge path.\n","modified":"2026-07-28T07:30:04.772773986Z","published":"2026-07-28T07:15:48Z","upstream":["CVE-2026-50812","CVE-2026-50813"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0305.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=35988"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-50812"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-50813"}],"affected":[{"package":{"name":"sqlite3","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/sqlite3?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-1.2.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0305.json"}},{"package":{"name":"sqlite3","ecosystem":"Mageia:9","purl":"pkg:rpm/mageia/sqlite3?arch=source&distro=mageia-9"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-1.10.mga9"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0305.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}