sqlite3 (3.31.1-4ubuntu0.7) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via sqlite3_db_config arguments
    - debian/patches/CVE-2025-29088.patch: harden SQLITE_DBCONFIG_LOOKASIDE
      interface against misuse in src/main.c, src/sqlite.h.in.
    - CVE-2025-29088

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 29 Apr 2025 13:16:28 -0400

sqlite3 (3.31.1-4ubuntu0.6) focal-security; urgency=medium

  * SECURITY UPDATE: heap overflow in sessionReadRecord
    - debian/patches/CVE-2023-7104.patch: fix a buffer overread in the
      sessions extension that could occur when processing a corrupt
      changeset in ext/session/sqlite3session.c.
    - CVE-2023-7104

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 02 Jan 2024 10:07:14 -0500

sqlite3 (3.31.1-4ubuntu0.5) focal-security; urgency=medium

  * SECURITY UPDATE: array-bounds overflow via large string argument
    - debian/patches/CVE-2022-35737.patch: increase the size of loop
      variables in src/printf.c.
    - CVE-2022-35737

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 04 Nov 2022 09:12:40 -0400

sqlite3 (3.31.1-4ubuntu0.4) focal-security; urgency=medium

  * SECURITY UPDATE: null pointer dereference in INTERSEC query processing
    - debian/patches/CVE-2020-35525.patch: early-out on the INTERSECT query
      processing following an error in src/select.c.
    - CVE-2020-35525
  * SECURITY UPDATE: out of bounds access problem
    - debian/patches/CVE-2020-35527.patch: fix a problem with ALTER TABLE
      for views that have a nested FROM clause in src/select.c,
      test/altertab.test.
    - CVE-2020-35527
  * SECURITY UPDATE: unicode61 tokenizer nul character mishandling
    - debian/patches/CVE-2021-20223.patch: prevent fts5 tokenizer unicode61
      from considering '0' to be  a token characters, even if other
      characters of class "Cc" are in ext/fts5/fts5_unicode2.c,
      ext/fts5/test/fts5tok1.test.
    - CVE-2021-20223

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 14 Sep 2022 12:44:43 -0400

sqlite3 (3.31.1-4ubuntu0.3) focal-security; urgency=medium
  
  * SECURITY UPDATE: segmentation fault in idxGetTableInfo
    - debian/patches/CVE-2021-36690.patch: perform validation
      over the column to ensure it has collating sequence in
      ext/expert/sqlite3expert.c
    - CVE-2021-36690

 -- David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>  Thu, 28 Apr 2022 15:24:31 +0200

sqlite3 (3.31.1-4ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: multiSelectOrderBy heap overflow
    - debian/patches/CVE-2020-15358.patch: fix defect in the
      query-flattener optimization in src/select.c, src/sqliteInt.h,
      test/selectA.test.
    - CVE-2020-15358

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Jul 2020 13:36:13 -0400

sqlite3 (3.31.1-4ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via malformed window-function query
    - debian/patches/CVE-2020-11655-2.patch: in the event of error,
      early-out in src/select.c, test/window1.test.
    - debian/patches/CVE-2020-11655-3.patch: do not suppress errors when
      resolving references in src/resolve.c, test/altertab.test.
    - CVE-2020-11655
  * SECURITY UPDATE: integer overflow in sqlite3_str_vappendf
    - debian/patches/CVE-2020-13434.patch: limit the "precision" of
      floating-point to text conversions in src/printf.c, test/printf.test.
    - CVE-2020-13434
  * SECURITY UPDATE: segmentation fault in sqlite3ExprCodeTarget
    - debian/patches/CVE-2020-13435-pre1.patch: move some utility Walker
      callbacks in src/expr.c, src/select.c, src/sqliteInt.h,
      src/walker.c.
    - debian/patches/CVE-2020-13435-1.patch: be sure to adjust the Expr.op2
      field appropriately in src/resolve.c, src/window.c,
      test/window1.test.
    - debian/patches/CVE-2020-13435-2.patch: add defensive code in
      src/expr.c.
    - CVE-2020-13435
  * SECURITY UPDATE: use-after-free in fts3EvalNextRow
    - debian/patches/CVE-2020-13630.patch: add fix to ext/fts3/fts3.c,
      test/fts3snippet.test.
    - CVE-2020-13630
  * SECURITY UPDATE: virtual table rename issue
    - debian/patches/CVE-2020-13631.patch: do not allow a virtual table to
      be renamed into the name of one of its shadows in src/alter.c,
      src/build.c, src/sqliteInt.h.
    - CVE-2020-13631
  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2020-13632.patch: fix issue in
      ext/fts3/fts3_snippet.c, test/fts3matchinfo2.test.
    - CVE-2020-13632

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 08 Jun 2020 08:43:24 -0400

sqlite3 (3.31.1-4) unstable; urgency=medium

  * Backport upstream fix for problems in the constant propagation
    optimization.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 05 Mar 2020 19:05:04 +0000

sqlite3 (3.31.1-3) unstable; urgency=high

  * Backport upstream security fixes for CVE-2020-9327: segmentation fault in
    isAuxiliaryVtabOperator() (closes: #951835).

  [ Kari Pahula <kaol@debian.org> ]
  * Provide sqldiff.1 manpage (closes: #861670).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 22 Feb 2020 10:43:26 +0000

sqlite3 (3.31.1-2) unstable; urgency=medium

  * Backport upstream fixes for big-endian architectures (closes: #950974):
    - compatibility with the s390 architecture,
    - adapt FTS test cases to work on big-endian platforms,
    - fix a problem in sqlite3CodecQueryParameters(),
    - fix a 4 byte OOB read in test_multiplex.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 09 Feb 2020 06:23:33 +0000

# For older changelog entries, run 'apt-get changelog lemon'
