The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0069 advisory.

    This advisory aggregates security fixes for the sqlite SRPM in CIQ LTS 8.6. It addresses 32 CVEs:
    CVE-2020-15358, CVE-2019-19880, CVE-2020-13435, CVE-2019-13734, CVE-2019-5827, and 27 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2018-8740

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

SQLite databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In SQLite through 3.22.0, databases whose schema is     corrupted using a CREATE TABLE AS statement could cause     a NULL pointer dereference, related to build.c and     prepare.c.(CVE-2018-8740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that SQLite's sqlite3VdbeExec() function     did not properly implement comparison operators. A     local attacker could submit a specially crafted CHECK     statement that would crash the SQLite process, or have     other unspecified impacts.(CVE-2015-3415)

  - A flaw was found in the way SQLite handled dequoting of     collation-sequence names. A local attacker could submit     a specially crafted COLLATE statement that would crash     the SQLite process, or have other unspecified     impacts.(CVE-2015-3414)

  - A NULL pointer dereference vulnerability was found in     SQLite. Loading a database whose schema was corrupted     using a CREATE TABLE AS statement would result in a     SQLite crash.(CVE-2018-8740)

  - It was found that SQLite's sqlite3VXPrintf() function     did not properly handle precision and width values     during floating-point conversions. A local attacker     could submit a specially crafted SELECT statement that     would crash the SQLite process, or have other     unspecified impacts.(CVE-2015-3416)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0493 advisory.

    This advisory aggregates security fixes for the sqlite SRPM in CIQ LTS 9.2. It addresses 6 CVEs:
    CVE-2022-35737, CVE-2025-6965, CVE-2019-19926, CVE-2017-10989, CVE-2018-8740, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the sqlite package has been released.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3431 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3431-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     May 22, 2023                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : sqlite     Version        : 2.8.17-15+deb10u1     CVE ID         : CVE-2016-6153 CVE-2018-8740     Debian Bug     :

    Two vulnerabilities have been fixed in sqlite (V2) which which might     allow local users to obtain sensitive information, cause a denial of     service (application crash), or have unspecified other impact.

    CVE-2016-6153

    sqlite improperly implemented the temporary directory search algorithm,     which might allow local users to obtain sensitive information, cause a     denial of service (application crash), or have unspecified other impact     by leveraging use of the current working directory for temporary files.

    CVE-2018-8740

    Databases whose schema is corrupted using a CREATE TABLE AS statement     could cause a NULL pointer dereference,


    For Debian 10 buster, these problems have been fixed in version     2.8.17-15+deb10u1.

    We recommend that you upgrade your sqlite packages.

    For the detailed security status of sqlite please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/sqlite

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several flaws were corrected in SQLite, a SQL database engine.

CVE-2017-2518

A use-after-free bug in the query optimizer may cause a buffer overflow and application crash via a crafted SQL statement.

CVE-2017-2519

Insufficient size of the reference count on Table objects could lead to a denial of service or arbitrary code execution.

CVE-2017-2520

The sqlite3_value_text() interface returned a buffer that was not large enough to hold the complete string plus zero terminator when the input was a zeroblob. This could lead to arbitrary code execution or a denial of service.

CVE-2017-10989

SQLite mishandles undersized RTree blobs in a crafted database leading to a heap-based buffer over-read or possibly unspecified other impact.

CVE-2018-8740

Databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference.

For Debian 8 'Jessie', these problems have been fixed in version 3.8.7.1-1+deb8u4.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4394-1 advisory.

    It was discovered that SQLite incorrectly handled certain corruped schemas. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-8740)

    It was discovered that SQLite incorrectly handled certain SELECT statements. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10.
    (CVE-2019-19603)

    It was discovered that SQLite incorrectly handled certain self-referential views. An attacker could     possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10.
    (CVE-2019-19645)

    Henry Liu discovered that SQLite incorrectly handled certain malformed window-function queries. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 19.10     and Ubuntu 20.04 LTS. (CVE-2020-11655)

    It was discovered that SQLite incorrectly handled certain string operations. An attacker could use this     issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13434)

    It was discovered that SQLite incorrectly handled certain expressions. An attacker could use this issue to     cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue     only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-13435)

    It was discovered that SQLite incorrectly handled certain fts3 queries. An attacker could use this issue     to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13630)

    It was discovered that SQLite incorrectly handled certain virtual table names. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10 and Ubuntu     20.04 LTS. (CVE-2020-13631)

    It was discovered that SQLite incorrectly handled certain fts3 queries. An attacker could use this issue     to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13632)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
358285	Rocky Linux 8.6 [CIQ] Security Update: lemon / lemon-debuginfo / sqlite / sqlite-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0069)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
108665	Fedora 27 : sqlite (2018-07e15ad5a5)	Nessus	Fedora Local Security Checks	2018/3/28	2024/12/3	high
108671	Fedora 26 : sqlite (2018-aace372c3f)	Nessus	Fedora Local Security Checks	2018/3/28	2024/12/3	high
111091	FreeBSD : SQLite -- Corrupt DB can cause a NULL pointer dereference (c1630aa3-7970-11e8-8634-dcfe074bd614)	Nessus	FreeBSD Local Security Checks	2018/7/16	2024/9/4	high
110140	EulerOS 2.0 SP1 : sqlite (EulerOS-SA-2018-1136)	Nessus	Huawei Local Security Checks	2018/5/29	2024/10/1	high
110844	EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2018-1180)	Nessus	Huawei Local Security Checks	2018/7/3	2024/9/10	high
120739	Fedora 28 : sqlite (2018-bb66329dee)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/1	high
124928	EulerOS Virtualization 3.0.1.0 : sqlite (EulerOS-SA-2019-1425)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high
355771	Rocky Linux 9.2 [CIQ] Security Update: lemon / lemon-debuginfo / sqlite / sqlite-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0493)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	high
203056	Photon OS 2.0: Sqlite PHSA-2018-2.0-0037	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
176213	Debian dla-3431 : libsqlite-tcl - security update	Nessus	Debian Local Security Checks	2023/5/22	2025/1/22	medium
108574	FreeBSD : SQLite -- Corrupt DB can cause a NULL pointer dereference (6d52bda1-2e54-11e8-a68f-485b3931c969)	Nessus	FreeBSD Local Security Checks	2018/3/23	2024/12/10	high
121133	Debian DLA-1633-1 : sqlite3 security update	Nessus	Debian Local Security Checks	2019/1/14	2024/6/27	critical
121829	Photon OS 1.0: Sqlite PHSA-2018-1.0-0126	Nessus	PhotonOS Local Security Checks	2019/2/7	2022/5/24	high
137353	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : SQLite vulnerabilities (USN-4394-1)	Nessus	Ubuntu Local Security Checks	2020/6/11	2025/9/3	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

medium

high

critical

high

high