QSN-8775-1: SQLite vulnerability
2026-09-16

Summary:
SQLite could be made to crash if it opened a specially crafted
file.

Details:
It was discovered that SQLite was vulnerable to a buffer overflow in
the sqlar extension. If a user were tricked into opening a specially
crafted SQLar archive, an attacker could cause a denial of service.

Affected QuantaStor releases:
  6.9.1.001 jammy: libsqlite3-0 3.37.2-2ubuntu0.8 (fixed in 3.37.2-2ubuntu0.8)
  6.9.1.001 jammy: sqlite3 3.37.2-2ubuntu0.8 (fixed in 3.37.2-2ubuntu0.8)
  6.9.1.001 jammy: sqlite3-tools 3.37.2-2ubuntu0.8 (fixed in 3.37.2-2ubuntu0.8)
  6.9.0.464 jammy: libsqlite3-0 3.37.2-2ubuntu0.8 (fixed in 3.37.2-2ubuntu0.8)
  6.9.0.464 jammy: sqlite3 3.37.2-2ubuntu0.8 (fixed in 3.37.2-2ubuntu0.8)
  6.9.0.464 jammy: sqlite3-tools 3.37.2-2ubuntu0.8 (fixed in 3.37.2-2ubuntu0.8)
  6.8.6.015 jammy: libsqlite3-0 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.6.015 jammy: sqlite3 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.6.015 jammy: sqlite3-tools 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.5.018 jammy: libsqlite3-0 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.5.018 jammy: sqlite3 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.5.018 jammy: sqlite3-tools 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.4.038 jammy: libsqlite3-0 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.4.038 jammy: sqlite3 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.4.038 jammy: sqlite3-tools 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.3.018 jammy: libsqlite3-0 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.3.018 jammy: sqlite3 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.3.018 jammy: sqlite3-tools 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.2.002 jammy: libsqlite3-0 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.2.002 jammy: sqlite3 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.2.002 jammy: sqlite3-tools 3.37.2-2ubuntu0.7 (fixed in 3.37.2-2ubuntu0.8)
  6.8.1.007 jammy: libsqlite3-0 3.37.2-2ubuntu0.6 (fixed in 3.37.2-2ubuntu0.8)
  6.8.1.007 jammy: sqlite3 3.37.2-2ubuntu0.6 (fixed in 3.37.2-2ubuntu0.8)
  6.8.1.007 jammy: sqlite3-tools 3.37.2-2ubuntu0.6 (fixed in 3.37.2-2ubuntu0.8)
  6.8.0.205 jammy: libsqlite3-0 3.37.2-2ubuntu0.6 (fixed in 3.37.2-2ubuntu0.8)
  6.8.0.205 jammy: sqlite3 3.37.2-2ubuntu0.6 (fixed in 3.37.2-2ubuntu0.8)
  6.8.0.205 jammy: sqlite3-tools 3.37.2-2ubuntu0.6 (fixed in 3.37.2-2ubuntu0.8)

CVEs: CVE-2026-39113

References:
  https://ubuntu.com/security/notices/USN-8775-1