In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

Multiple Vulnerabilities in SQLite

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1456-1 advisory.

    - CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function (bsc#1241020)
    - CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

    Other fixes:

    - Updated to version 3.49.1 from Factory (jsc#SLE-16032)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1455-1 advisory.

    - CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function (bsc#1241020)
    - CVE-2025-29088: Fixed integer overflow through the SQLITE_DBCONFIG_LOOKASIDE component (bsc#1241078)

    Other fixes:

    - Updated to version 3.49.1 from Factory (jsc#SLE-16032)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 409206f6-25e6-11f0-9360-b42e991fc52e advisory.

    cve@mitre.org reports:

            In SQLite 3.44.0 through 3.49.0 before 3.49.1, the             concat_ws() SQL function can cause memory to be written             beyond the end of a malloc-allocated buffer. If the             separator argument is attacker-controlled and has a large             string (e.g., 2MB or more), an integer overflow occurs in             calculating the size of the result buffer, and thus malloc             may not allocate enough memory.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sqlite 3.49.0 is susceptible to integer overflow through the concat function. (CVE-2025-29087)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
235652	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : sqlite3 (SUSE-SU-2025:1456-1)	Nessus	SuSE Local Security Checks	medium
235650	SUSE SLES12 Security Update : sqlite3 (SUSE-SU-2025:1455-1)	Nessus	SuSE Local Security Checks	medium
235065	FreeBSD : sqlite -- integer overflow (409206f6-25e6-11f0-9360-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high
234212	Linux Distros Unpatched Vulnerability : CVE-2025-29087	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-29087

high

Tenable Plugins

Coming Soon

medium

medium

high

critical