Detections
Analytics

EulerOS Virtualization 2.11.0 : sqlite (EulerOS-SA-2026-3561)

high Nessus Plugin ID 348018

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.(CVE-2025-29088)

 There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.(CVE-2025-6965)

 An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.(CVE-2025-70873)

 SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.(CVE-2026-11824)

 SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.(CVE-2026-11822)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sqlite security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected sqlite packages.

See Also

http://www.nessus.org/u?f5395372

Plugin Details

Severity: High

ID: 348018

File Name: EulerOS_SA-2026-3561.nasl

Version: 1.2

Type: Local

Published: 9/18/2026

Updated: 9/21/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

Percentile: 98.24

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:C/A:P

CVSS Score Source: CVE-2025-6965

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.9

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 7.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-11824

Vulnerability Information

CPE: cpe:/o:huawei:euleros:uvp:2.11.0, p-cpe:/a:huawei:euleros:sqlite-devel, p-cpe:/a:huawei:euleros:sqlite-help, p-cpe:/a:huawei:euleros:sqlite

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/16/2026

Vulnerability Publication Date: 12/12/2023

Reference Information

CVE: CVE-2025-29088, CVE-2025-6965, CVE-2025-70873, CVE-2026-11822, CVE-2026-11824

IAVA: 2025-A-0288-S, 2026-A-0245, 2026-A-0641-S