{"id":"GHSA-2m69-gcr7-jv3q","summary":"SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite","details":"There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.","aliases":["BIT-sqlite-2025-6965","CVE-2025-6965"],"modified":"2026-06-18T13:26:29.429556259Z","published":"2025-07-15T15:31:00Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-06-18T13:01:42Z","nvd_published_at":"2025-07-15T14:15:31Z","cwe_ids":["CWE-197"]},"references":[{"type":"WEB","url":"https://github.com/google/security-research/security/advisories/GHSA-qj7j-3jp8-8ccv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6965"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/7675"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-225816.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-485750.html"},{"type":"PACKAGE","url":"https://github.com/ericsink/SQLitePCL.raw"},{"type":"WEB","url":"https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/49"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/53"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/56"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/57"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/58"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/09/06/1"}],"affected":[{"package":{"name":"SQLitePCLRaw.lib.e_sqlite3","ecosystem":"NuGet","purl":"pkg:nuget/SQLitePCLRaw.lib.e_sqlite3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.11"}]}],"versions":["2.0.0","2.0.0-pre20190620134904","2.0.0-pre20190621100518","2.0.0-pre20190625090255","2.0.0-pre20190628101813","2.0.0-pre20190815131715","2.0.1","2.0.1-pre20190815133105","2.0.2","2.0.2-pre20190904113843","2.0.2-pre20191003102319","2.0.2-pre20191018090318","2.0.3","2.0.4","2.0.4-pre20200828111558","2.0.5","2.0.5-pre20201231105030","2.0.5-pre20210119130047","2.0.5-pre20210521085756","2.0.5-pre20210817120427","2.0.5-pre20210824155428","2.0.5-pre20210824155535","2.0.6","2.0.6-pre20210902144138","2.0.7","2.0.7-pre20210929171745","2.0.8-pre20220111224339","2.1.0","2.1.0-pre20220207195309","2.1.0-pre20220207221914","2.1.0-pre20220318192836","2.1.0-pre20220427180151","2.1.1","2.1.1-pre20220822172036","2.1.10","2.1.10-pre20240828193256","2.1.11","2.1.11-pre20241216174303","2.1.2","2.1.2-pre20220913165057","2.1.2-pre20220916165053","2.1.3","2.1.3-pre20221111222311","2.1.4","2.1.4-pre20230105221937","2.1.5","2.1.5-pre20230516213315","2.1.6","2.1.6-pre20230809203314","2.1.7","2.1.7-pre20231110210158","2.1.7-pre20231117161811","2.1.8","2.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-2m69-gcr7-jv3q/GHSA-2m69-gcr7-jv3q.json"}},{"package":{"name":"SQLitePCLRaw.lib.e_sqlite3.android","ecosystem":"NuGet","purl":"pkg:nuget/SQLitePCLRaw.lib.e_sqlite3.android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.11"}]}],"versions":["1.0.0","1.0.0-pre20160901085507","1.0.0-pre20160912104037","1.0.1","1.1.0","1.1.0-pre20160928150051","1.1.1","1.1.1-pre20161109081005","1.1.10","1.1.10-pre20180223200113","1.1.11","1.1.12","1.1.13","1.1.14","1.1.2","1.1.3","1.1.3-pre20170220084037","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","2.0.0","2.0.0-pre20190620134904","2.0.0-pre20190621100518","2.0.0-pre20190625090255","2.0.0-pre20190628101813","2.0.1","2.0.2","2.0.2-pre20190904113843","2.0.2-pre20191003102319","2.0.2-pre20191018090318","2.0.3","2.0.4","2.0.4-pre20200828111558","2.0.5","2.0.5-pre20201231105030","2.0.5-pre20210119130047","2.0.5-pre20210521085756","2.0.5-pre20210817120427","2.0.5-pre20210824155428","2.0.5-pre20210824155535","2.0.6","2.0.6-pre20210902144138","2.0.7","2.0.7-pre20210929171745","2.0.8-pre20220111224339","2.1.0","2.1.0-pre20220207195309","2.1.0-pre20220207221914","2.1.0-pre20220318192836","2.1.0-pre20220427180151","2.1.1","2.1.1-pre20220822172036","2.1.10","2.1.10-pre20240828193256","2.1.11","2.1.11-pre20241216174303","2.1.2","2.1.2-pre20220913165057","2.1.2-pre20220916165053","2.1.3","2.1.3-pre20221111222311","2.1.4","2.1.4-pre20230105221937","2.1.5","2.1.5-pre20230516213315","2.1.6","2.1.6-pre20230809203314","2.1.7","2.1.7-pre20231110210158","2.1.7-pre20231117161811","2.1.8","2.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-2m69-gcr7-jv3q/GHSA-2m69-gcr7-jv3q.json"}},{"package":{"name":"SQLitePCLRaw.lib.e_sqlite3.ios","ecosystem":"NuGet","purl":"pkg:nuget/SQLitePCLRaw.lib.e_sqlite3.ios"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.11"}]}],"versions":["2.0.0","2.0.0-pre20190620134904","2.0.0-pre20190621100518","2.0.0-pre20190625090255","2.0.0-pre20190628101813","2.0.1","2.0.2","2.0.2-pre20190904113843","2.0.2-pre20191003102319","2.0.2-pre20191018090318","2.0.3","2.0.4","2.0.4-pre20200828111558","2.0.5","2.0.5-pre20201231105030","2.0.5-pre20210119130047","2.0.5-pre20210521085756","2.0.5-pre20210817120427","2.0.5-pre20210824155428","2.0.5-pre20210824155535","2.0.6","2.0.6-pre20210902144138","2.0.7","2.0.7-pre20210929171745","2.0.8-pre20220111224339","2.1.0","2.1.0-pre20220207195309","2.1.0-pre20220207221914","2.1.0-pre20220318192836","2.1.0-pre20220427180151","2.1.1","2.1.1-pre20220822172036","2.1.10","2.1.10-pre20240828193256","2.1.11","2.1.11-pre20241216174303","2.1.2","2.1.2-pre20220913165057","2.1.2-pre20220916165053","2.1.3","2.1.3-pre20221111222311","2.1.4","2.1.4-pre20230105221937","2.1.5","2.1.5-pre20230516213315","2.1.6","2.1.6-pre20230809203314","2.1.7","2.1.7-pre20231110210158","2.1.7-pre20231117161811","2.1.8","2.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-2m69-gcr7-jv3q/GHSA-2m69-gcr7-jv3q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green"}]}