Moderate: mingw packages security and bug fix update
Summary
ALSA-2021:1968: Moderate: mingw packages security and bug fix update. Affects mingw-binutils-generic versions < 2.30-3.el8. Fixed in 2.30-3.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MinGW is a free and open source software development environment used to create Microsoft Windows applications. It provides a set of tools and libraries that allow developers to compile and build Windows applications using the GNU Compiler Collection (GCC). The mingw-sqlite package is a component of MinGW that includes the SQLite database engine. SQLite is a popular embedded database library used in many applications. This vulnerability affects the mingw-sqlite package.
Vulnerability Detail
The vulnerability in the mingw-sqlite package is categorized as moderate. It includes several security fixes:
- CVE-2019-16168: Division by zero in whereLoopAddBtreeIndex in sqlite3.c
- CVE-2020-13434: Integer overflow in sqlite3_str_vappendf function in printf.c
- CVE-2020-13630: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c
- CVE-2020-13631: Virtual table can be renamed into the name of one of its shadow tables
- CVE-2020-13632: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query
These vulnerabilities could potentially lead to various security issues, such as arbitrary code execution, denial of service, or information disclosure.
How To Fix
Minimum fixed version
2.30-3.el8
This is the first release that contains the fix.
sudo dnf update mingw-binutils-genericTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The mingw-sqlite package in MinGW has been found to have several security vulnerabilities. To mitigate these vulnerabilities, it is crucial to update the package to the latest version. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mingw-binutils-generic →
FAQ
MinGW is a free and open source software development environment used to create Microsoft Windows applications. It provides a set of tools and libraries that allow developers to compile and build Windows applications using the GNU Compiler Collection (GCC).
mingw-sqlite is a package in MinGW that includes the SQLite database engine. SQLite is a popular embedded database library used in many applications.
These vulnerabilities could potentially lead to various security issues, such as arbitrary code execution, denial of service, or information disclosure.
To fix the vulnerability, it is recommended to update the mingw-sqlite package to the latest version (3.26.0.0). This can be done by running the package manager and installing the available updates.
No specific workaround has been mentioned for these vulnerabilities. It is recommended to update the package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for mingw-binutils-generic.
