Detections
Analytics
EulerOS Virtualization 2.11.1 : sqlite (EulerOS-SA-2026-3474)
high Nessus Plugin ID 347306
Synopsis
The remote EulerOS Virtualization host is missing multiple security updates.Description
According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.(CVE-2025-29088)
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.(CVE-2025-6965)
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.(CVE-2026-11824)
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.(CVE-2026-11822)
Tenable has extracted the preceding description block directly from the EulerOS Virtualization sqlite security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected sqlite packages.See Also
Plugin Details
Severity: High
ID: 347306
File Name: EulerOS_SA-2026-3474.nasl
Version: 1.1
Type: Local
Family: Huawei Local Security Checks
Published: 9/18/2026
Updated: 9/18/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
Percentile: 98.46
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2025-29088
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.5
Threat Score: 7.1
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-11824
Vulnerability Information
CPE: cpe:/o:huawei:euleros:uvp:2.11.1, p-cpe:/a:huawei:euleros:sqlite-devel, p-cpe:/a:huawei:euleros:sqlite-help, p-cpe:/a:huawei:euleros:sqlite
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/16/2026
Vulnerability Publication Date: 12/12/2023
Reference Information
CVE: CVE-2025-29088, CVE-2025-6965, CVE-2025-70873, CVE-2026-11822, CVE-2026-11824
IAVA: 2025-A-0288-S, 2026-A-0245, 2026-A-0641-S