News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in SQLite. Parent comment

Re:Remote code execution vulnerability in SQLite by cdelsolar on Friday December 14, 2018 @05:36PM (#18685525)
They say to update to this SQLite version: https://www.sqlite.org/releaselog/3_26_0.html

Skimming that log doesn't give me any ideas.. maybe the diff would help elucidate?

[ Parent | on HN ]
Re:Remote code execution vulnerability in SQLite by Serow225 on Friday December 14, 2018 @05:39PM (#18685544)
Maybe related to this, as a guess? https://www.sqlite.org/c3ref/c_dbconfig_defensive.html#sqlit...

SQLITE_DBCONFIG_DEFENSIVE The SQLITE_DBCONFIG_DEFENSIVE option activates or deactivates the "defensive" flag for a database connection. When the defensive flag is enabled, language features that allow ordinary SQL to deliberately corrupt the database file are disabled. The disabled features include but are not limited to the following: The PRAGMA writable_schema=ON statement. Writes to the sqlite_dbpage virtual table. Direct writes to shadow tables.

[ Parent | on HN ]
Re:Remote code execution vulnerability in SQLite by schlarpc on Friday December 14, 2018 @05:43PM (#18685578)
The Chrome update only bumped to 3.25.3, so it's likely a commit between 3.24.0 and 3.25.3:

https://chromium.googlesource.com/chromium/src/+/c368e30ae55...

[ Parent | on HN ]