CVE-2022-35737 @ mufasa

"CVE-2022-35737"
"sqlite-3.7.17-8.0.1.el7_7.1.tuxcare.els1"
"alt-sqlite-3.53.4-1.el7"
"cpanel-sqlite-3.50.3-1.cp108~el7"
"Am I vulnerable?"

Status

not_applicable

Priority

7.0

Match score

4.0

Risk

DoS Remote

CVSS

7.5 HIGH

Reason

cpe: sqlite; pkgs: sqlite; version: in-range: sqlite-3.7.17-8.0.1.el7_7.1.tuxcare.els1; risk:dos

Created

2026-10-20T18:18:05Z

Updated

2026-10-20T19:09:05Z

Closed

2026-10-20T18:47:05Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

Package	Commands
sqlite-3.7.17-8.0.1.el7_7.1.tuxcare.els1
alt-sqlite-3.53.4-1.el7
cpanel-sqlite-3.50.3-1.cp108~el7

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: sqlite

System	Matches	Ticket for CVE-2022-35737
morris	alt-php52-sqlite 5.2.17; alt-php53-sqlite 5.3.29; alt-sqlite 3.53.4; cpanel-perl-536-dbd-sqlite 1.72; cpanel-perl-536-dbd-sqlite2 0.38; cpanel-sqlite 3.50.3; perl-DBD-SQLite 1.39; sqlite 3.7.17	not_applicable open
mufasa	alt-sqlite 3.53.4; cpanel-perl-536-dbd-sqlite 1.72; cpanel-perl-536-dbd-sqlite2 0.38; cpanel-sqlite 3.50.3; perl-DBD-SQLite 1.39; sqlite 3.7.17	not_applicable open
Archive	libaprutil1-dbd-sqlite3 1.6.1-4+deb10u1; libsqlite3-0 3.27.2-3+deb10u2	none
Bullseye	libaprutil1-dbd-sqlite3 1.6.1-5+deb11u1; libsqlite3-0 3.34.1-3+deb11u1	none
Helios	libaprutil1-dbd-sqlite3 1.6.1-5+deb11u1; libopendbx1-sqlite3 1.4.6-15; libsqlite3-0 3.34.1-3+deb11u1	none
Janus	libaprutil1-dbd-sqlite3 1.6.1-4+deb10u1; libsqlite3-0 3.27.2-3+deb10u2	none
Library	libaprutil1-dbd-sqlite3 1.5.4-3; libopendbx1-sqlite3 1.4.6-11+b1; libsqlite3-0 3.16.2-5+deb9u3	none
Matrix	libsqlite3-0 3.40.1-2+deb12u2; sqlite3 3.40.1-2+deb12u2	none
Saiph	libqt5sql5-sqlite 5.11.3+dfsg1-1+deb10u6; libsqlite3-0 3.27.2-3+deb10u2; postfix-sqlite 3.1.8-0+deb9u1	none
Silk	alt-sqlite 3.53.4-1; libaprutil1-dbd-sqlite3 1.6.3-1+deb12u1; libsqlite3-0 3.40.1-2+deb12u2	none

Related CVE (same fix)

This CVE is subordinated to primary CVE-2025-6965 — same product as CVE-2025-6965

Host OS / kernel

CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux

Arch

x86_64

kernel_release

uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64

kernel_version

uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	not_applicable	7.0	2026-10-20T19:09:05Z	Open

Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Determination

Related to primary CVE-2025-6965: same product as CVE-2025-6965

Update status

Add note only

Mitigation log

2026-10-20T18:47:05Z — not_applicable

Related to primary CVE-2025-6965: same product as CVE-2025-6965

References

NVD: CVE-2022-35737