diff --git a/SPECS/sqlite/CVE-2025-6965.patch b/SPECS/sqlite/CVE-2025-6965.patch new file mode 100644 index 00000000000..b9e7359fcda --- /dev/null +++ b/SPECS/sqlite/CVE-2025-6965.patch @@ -0,0 +1,36 @@ +From 21fd260b719da5aa881c760f2d11997ec0d7d28a Mon Sep 17 00:00:00 2001 +From: Kshitiz Godara +Date: Mon, 4 Aug 2025 06:48:07 +0000 +Subject: [PATCH 2/2] Fix for CVE-2025-6965 [HIGH] + +Upstream reference: +https://www.sqlite.org/src/info/642be27a38018649 +--- + sqlite3.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 70c9b45..003961a 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -109837,7 +109837,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ + ExprSetVVAProperty(pExpr, EP_NoReduce); + pExpr->pAggInfo = pAggInfo; + pExpr->op = TK_AGG_COLUMN; +- pExpr->iAgg = (i16)k; ++ pExpr->iAgg = (i16)(k&0x7fff); + break; + } /* endif pExpr->iTable==pItem->iCursor */ + } /* end loop over pSrcList */ +@@ -109883,7 +109883,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ + */ + assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) ); + ExprSetVVAProperty(pExpr, EP_NoReduce); +- pExpr->iAgg = (i16)i; ++ pExpr->iAgg = (i16)(i&0x7fff); + pExpr->pAggInfo = pAggInfo; + return WRC_Prune; + }else{ +-- +2.45.4 + diff --git a/SPECS/sqlite/CVE-2025-7458.patch b/SPECS/sqlite/CVE-2025-7458.patch new file mode 100644 index 00000000000..5245d46a70e --- /dev/null +++ b/SPECS/sqlite/CVE-2025-7458.patch @@ -0,0 +1,29 @@ +From 7b06377c3e3ec165a0024b3950ae71b39e7bfcc7 Mon Sep 17 00:00:00 2001 +From: Kshitiz Godara +Date: Sun, 3 Aug 2025 16:51:50 +0000 +Subject: [PATCH 1/2] Fix for CVE-2025-7458 [MEDIUM] + +Upstream reference: +https://sqlite.org/src/info/12ad822d9b827777 +--- + sqlite3.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sqlite3.c b/sqlite3.c +index 158d416..70c9b45 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -158940,6 +158940,10 @@ static int wherePathSolver(WhereInfo *pWInfo, LogEst nRowEst){ + if( pFrom->isOrdered==pWInfo->pOrderBy->nExpr ){ + pWInfo->eDistinct = WHERE_DISTINCT_ORDERED; + } ++ if( pWInfo->pOrderBy ++ && pWInfo->nOBSat > pWInfo->pOrderBy->nExpr ){ ++ pWInfo->nOBSat = pWInfo->pOrderBy->nExpr; ++ } + }else{ + pWInfo->revMask = pFrom->revLoop; + if( pWInfo->nOBSat<=0 ){ +-- +2.45.4 + diff --git a/SPECS/sqlite/sqlite.spec b/SPECS/sqlite/sqlite.spec index cc8f8df5645..ea50ad4421a 100644 --- a/SPECS/sqlite/sqlite.spec +++ b/SPECS/sqlite/sqlite.spec @@ -2,7 +2,7 @@ Summary: A portable, high level programming interface to various calling conventions Name: sqlite Version: 3.39.2 -Release: 3%{?dist} +Release: 4%{?dist} License: Public Domain Vendor: Microsoft Corporation Distribution: Mariner @@ -13,6 +13,8 @@ Source0: https://www.sqlite.org/2022/%{name}-autoconf-%{sourcever}.tar.gz Patch0: CVE-2015-3717.nopatch Patch1: CVE-2022-46908.patch Patch2: CVE-2023-7104.patch +Patch3: CVE-2025-7458.patch +Patch4: CVE-2025-6965.patch Requires: sqlite-libs = %{version}-%{release} Provides: sqlite3 @@ -83,6 +85,9 @@ make %{?_smp_mflags} check %{_libdir}/libsqlite3.so.0.8.6 %changelog +* Mon Aug 04 2025 Kshitiz Godara - 3.39.2-4 +- Address CVE-2025-6965 and CVE-2025-7458 + * Tue Jan 09 2024 Henry Li - 3.39.2-3 - Address CVE-2023-7104 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 1ee0b4685fb..b207e62a337 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -84,9 +84,9 @@ bison-3.7.6-2.cm2.aarch64.rpm popt-1.18-1.cm2.aarch64.rpm popt-devel-1.18-1.cm2.aarch64.rpm popt-lang-1.18-1.cm2.aarch64.rpm -sqlite-3.39.2-3.cm2.aarch64.rpm -sqlite-devel-3.39.2-3.cm2.aarch64.rpm -sqlite-libs-3.39.2-3.cm2.aarch64.rpm +sqlite-3.39.2-4.cm2.aarch64.rpm +sqlite-devel-3.39.2-4.cm2.aarch64.rpm +sqlite-libs-3.39.2-4.cm2.aarch64.rpm elfutils-0.186-2.cm2.aarch64.rpm elfutils-default-yama-scope-0.186-2.cm2.noarch.rpm elfutils-devel-0.186-2.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 29b6a28f866..b62e14e4579 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -84,9 +84,9 @@ bison-3.7.6-2.cm2.x86_64.rpm popt-1.18-1.cm2.x86_64.rpm popt-devel-1.18-1.cm2.x86_64.rpm popt-lang-1.18-1.cm2.x86_64.rpm -sqlite-3.39.2-3.cm2.x86_64.rpm -sqlite-devel-3.39.2-3.cm2.x86_64.rpm -sqlite-libs-3.39.2-3.cm2.x86_64.rpm +sqlite-3.39.2-4.cm2.x86_64.rpm +sqlite-devel-3.39.2-4.cm2.x86_64.rpm +sqlite-libs-3.39.2-4.cm2.x86_64.rpm elfutils-0.186-2.cm2.x86_64.rpm elfutils-default-yama-scope-0.186-2.cm2.noarch.rpm elfutils-devel-0.186-2.cm2.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index d48b809ebc2..8b0cb362d6c 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -548,10 +548,10 @@ sed-lang-4.8-3.cm2.aarch64.rpm slang-2.3.2-4.cm2.aarch64.rpm slang-debuginfo-2.3.2-4.cm2.aarch64.rpm slang-devel-2.3.2-4.cm2.aarch64.rpm -sqlite-3.39.2-3.cm2.aarch64.rpm -sqlite-debuginfo-3.39.2-3.cm2.aarch64.rpm -sqlite-devel-3.39.2-3.cm2.aarch64.rpm -sqlite-libs-3.39.2-3.cm2.aarch64.rpm +sqlite-3.39.2-4.cm2.aarch64.rpm +sqlite-debuginfo-3.39.2-4.cm2.aarch64.rpm +sqlite-devel-3.39.2-4.cm2.aarch64.rpm +sqlite-libs-3.39.2-4.cm2.aarch64.rpm swig-4.0.2-3.cm2.aarch64.rpm swig-debuginfo-4.0.2-3.cm2.aarch64.rpm systemd-bootstrap-250.3-13.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 82ff3745b51..c1a0db48713 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -554,10 +554,10 @@ sed-lang-4.8-3.cm2.x86_64.rpm slang-2.3.2-4.cm2.x86_64.rpm slang-debuginfo-2.3.2-4.cm2.x86_64.rpm slang-devel-2.3.2-4.cm2.x86_64.rpm -sqlite-3.39.2-3.cm2.x86_64.rpm -sqlite-debuginfo-3.39.2-3.cm2.x86_64.rpm -sqlite-devel-3.39.2-3.cm2.x86_64.rpm -sqlite-libs-3.39.2-3.cm2.x86_64.rpm +sqlite-3.39.2-4.cm2.x86_64.rpm +sqlite-debuginfo-3.39.2-4.cm2.x86_64.rpm +sqlite-devel-3.39.2-4.cm2.x86_64.rpm +sqlite-libs-3.39.2-4.cm2.x86_64.rpm swig-4.0.2-3.cm2.x86_64.rpm swig-debuginfo-4.0.2-3.cm2.x86_64.rpm systemd-bootstrap-250.3-13.cm2.x86_64.rpm