linux/poky.git/meta/recipes-support/sqlite, branch sumo

sqlite3: CVE-2018-8740

2018-09-27T11:17:46+00:00

* CVE-2018-8740 In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c. Affects sqlite3 <= 3.22.0 CVE: CVE-2018-8740 Ref: https://access.redhat.com/security/cve/cve-2018-8740 (From OE-Core rev: 0469c075d904026ec37214fb39397bb1cb07ab43) Signed-off-by: Sinan Kaya Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

sqlite3: consistent set of features for nativesdk

2018-07-02T10:41:26+00:00

Enable use of pread() and enable column metadata API for nativesdk builds. This brings nativesdk in line with target and native builds. (From OE-Core rev: 7c8b85e1c3d852975cd5961a297aa939bf4c7fe7) (From OE-Core rev: b476119fb72511fb384600db659c73c9bd6486e8) Signed-off-by: Richard Purdie (cherry picked from commit 086610faf03a4c3e01cdb9d69c002b66813d97e3) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

sqlite3: upgrade to version 3.22.0

2018-01-26T13:09:10+00:00

Update SRC_URI for releases in 2018. (From OE-Core rev: fff2409587e8a253c1f79a3d3c78907440402188) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.21.0

2017-11-21T13:06:11+00:00

Remove upstreamed patch: 1. sqlite3-fix-CVE-2017-13685.patch (From OE-Core rev: 483711e676cd063a873179bdb2daedf56de0aa75) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: fix CVE-2017-13685

2017-10-16T22:52:44+00:00

The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. Backport patch to fix the issue. Some references: https://sqlite.org/src/info/02f0f4c54f2819b3 http://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg105314.html (From OE-Core rev: 9b9f566d2042f2b393de88506d2da964bc4d17b0) Signed-off-by: Wenzong Fan Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.2.0

2017-08-18T09:40:27+00:00

* Uprev from 3.19.3 to 3.2.0 for fixing CVE-2017-10989: The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact. https://nvd.nist.gov/vuln/detail/CVE-2017-10989 * LIC_FILES_CHKSUM updated for below changes: -** 2001 September 15 +** 2001-09-15 (From OE-Core rev: 95b802bfe74ac6a3f6dc05edb52c87ef90600f40) Signed-off-by: Wenzong Fan Signed-off-by: Richard Purdie

sqlite3.inc: set CVE_PRODUCT to sqlite

2017-07-24T08:13:31+00:00

It is used in NVD for CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2016-6153 (From OE-Core rev: cec6f26f4d2f16c9a58fac5a6344e3d43b36ed09) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.19.3

2017-07-21T21:51:38+00:00

3.19.2 -> 3.19.3 Fixes a bug associated with auto_vacuum that can lead to database corruption. (From OE-Core rev: 2635067901c932888a998ea0fbb45f5d4d3c7c24) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade 3.18.0 -> 3.19.2

2017-06-03T22:46:06+00:00

Bug fixes: 1. Fix a problem in REPLACE that can result in a corrupt database containing two or more rows with the same rowid. 2. Fix a problem in PRAGMA integrity_check that was causing a subsequent VACUUM to behave suboptimally. 3. Fix the PRAGMA foreign_key_check command so that it works correctly with foreign keys on WITHOUT ROWID tables. 4. Disallow leading zeros in numeric constants in JSON. 5. Disallow control characters inside of strings in JSON. 6. Limit the depth of recursion for JSON objects and arrays in order to avoid excess stack usage in the recursive descent parser. 7. Fix more bugs in the LEFT JOIN flattening optimization. (From OE-Core rev: 3d4d025b1cc6668fd7baefa01ebb9664e805e83a) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.18.0

2017-05-18T13:01:48+00:00

(From OE-Core rev: 6949d865d3559fa37ff25de4b97c4460b42e0e9c) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie