An out of bounds read flaw was found in the SQLite component of the Chromium browser. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=1025470 External References: https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
Created chromium tracking bugs for this issue: Affects: epel-7 [bug 1782013] Affects: fedora-all [bug 1782012]
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Via RHSA-2019:4238 https://access.redhat.com/errata/RHSA-2019:4238
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-13752
While the chromium bug is not public yet, its id leads us to this: https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/47bd97d715260127c995d92dde8dd8adb669b6b3 https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/47bd97d715260127c995d92dde8dd8adb669b6b3/patches/0002-Improve-shadow-table-corruption-detection-in-fts3.patch which further leads us to upstream commit: https://www.sqlite.org/src/info/04b2873be5aedeb1 https://github.com/sqlite/sqlite/commit/94febb3a77a8c79bc090119585fc7878f44bbf38 There is no released sqlite version with the fix yet.
Created mingw-sqlite tracking bugs for this issue: Affects: epel-all [bug 1786526] Affects: fedora-all [bug 1786525] Created sqlite tracking bugs for this issue: Affects: fedora-all [bug 1786524]
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1810 https://access.redhat.com/errata/RHSA-2020:1810