-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 31 Oct 2026 16:28:17 +0100 Source: sqlite3 Architecture: source Version: 3.54.1-1 Distribution: unstable Urgency: high Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org> Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org> Closes: 1128611 1142081 1152790 Changes: sqlite3 (3.54.1-1) unstable; urgency=high . [ Laszlo Boszormenyi (GCS) ] * New upstream release: - fixes CVE-2026-119371: stack exhaustion vulnerability (closes: #1152790), - fixes CVE-2026-119372: use after free vulnerability in FTS3/FTS4 snippet(), - fixes CVE-2026-119373: heap buffer overflow in fts5MergeRowidLists() when built with FTS5, - fixes CVE-2026-119374: FTS5 secure-delete code could lead to a buffer overrun, - fixes CVE-2026-119375: uninitialized page-buffer disclosure via WAL/DB page-size mismatch, - fixes CVE-2026-119376: a stack exhaustion vulnerability, - fixes CVE-2026-119377: authorization bypass vulnerability in the lookupName() function, - fixes CVE-2026-119378: avoid a use after free problem in rtree module, - fixes CVE-2026-119379: heap out of bounds write in the sqlite3changeset_apply() function, - fixes CVE-2026-119591: a stack exhaustion vulnerability in the countOfViewOptimization() function. * Add sqlite3_rsync to sqlite3-tools package (closes: #1142081). * Remove sqlite3IsBinary@Base, sqlite3ResultStrAccum@Base, sqlite3VdbeAddOp4Dup8@Base and sqlite3VdbeSetVarmask@Base symbols as no longer part of the library. * Update symbols file. . [ Sergei Golovan <sgolovan@debian.org> ] * Add Tcl 9.1 compatibility (closes: #1128611). . [ Gregor Ebbing <gregor.ebbing@gmx.de> ] * Additional libsqlite3-tcl packaging fixes. Checksums-Sha1: adad8188a1de9f6403ff70b3e41ea62465d3ae22 2648 sqlite3_3.54.1-1.dsc 8bc602b0433a4cc92fe095627afe1c89e1335cb5 6403124 sqlite3_3.54.1.orig-www.tar.xz c49acf244fe87e12aa11698a792dd6090c1b4eb9 8871620 sqlite3_3.54.1.orig.tar.xz a8d6dc71abece0bd8f04fc52c793728ef7340a4d 32312 sqlite3_3.54.1-1.debian.tar.xz Checksums-Sha256: d3b2efbeb509dfac38a0653112a400d48eaa86f14432c255a6fea8569df407f1 2648 sqlite3_3.54.1-1.dsc 67906ee141109bebe43cdcf197892806397dabc79f5cd7f05f1278f47b0c5e25 6403124 sqlite3_3.54.1.orig-www.tar.xz faeff7682200b3dd58c8f0f229892a7271c73c1fdabc86e7315eb31eb7cb6e83 8871620 sqlite3_3.54.1.orig.tar.xz 3f05602b0f4e1441b88f92e9afb2980e148659842565b1f1e27012988433a1d9 32312 sqlite3_3.54.1-1.debian.tar.xz Files: 1b874da056dc10031f4006168f2c0f10 2648 devel optional sqlite3_3.54.1-1.dsc 52cadbc2166ce2bf431f652e643b8c08 6403124 devel optional sqlite3_3.54.1.orig-www.tar.xz 35236c897e322b0a6889e5ba06104a84 8871620 devel optional sqlite3_3.54.1.orig.tar.xz 939dce46bc0d7c5e1a953312bdcebb06 32312 devel optional sqlite3_3.54.1-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmrpA+8ACgkQ3OMQ54ZM yL8U3g//RBdnbxg+dqa1tnql+G6b3+Ci1ltEog8TsnVWtOYXwshMHtBJU5lGDmgb YHYzTUX4MTT3yX+byxdOrUhd2kCNhnriZsBcY6X8vNfKI+SLoGxdoBLFBffVNu8y 5UhvgEN8fS8KbcANkWJGNCu7N5NXEKD8XZgHRv/u+rRLgDJmDB52dFP2bd1OCYwG /UmJgGYZiel8DSZN1zBpRcAmUJZCwx5swdTs2qZut+IeNbGqkZ8P2+AIDS+7PvAO Cxul911v1ixXqX0MroQbQAL8/OnER3aIZ46j7yDuaWoobcBnQaEA6jqxv6YPuczs f1Vmmlxo9/b2YisPlI36WvQ+RSsR0P+YK2auKSp+RFRSwt/TvJTZEo6K6FkGcaps I95ZaP5lkG7kO+dCU84M18+eTZAz6mKfoLlsHnSgqOOlydkgZpTGUWhr9MDjSKeS VsiX2DuqPPb90E263UrQnroTyThdM0kMJDVfYBLSXTPjTc7tW0Gm1lw37YjwZyr8 kNj8xuFaTECDg4gCoGoH9/U/b2y9qEXuMmJTlEbydofRSPx9p3qBbopEQVOReIbe tHdWkCLnfZvK8dCK9L212wHwCAKf4wVRRd1rkFDC1zHv8EHtPVDXSZhBjlt4G9C8 EEZ+R/vWUMy06rsbF9i17l2573pfN7YGc6Uk96tuLyipNcezz1w= =X92q -----END PGP SIGNATURE-----
