[AutoPR- Security] Patch sqlite for CVE-2026-11822, CVE-2026-11824 [HIGH] (microsoft#17688)

Co-authored-by: kgodara912 <kshigodara@outlook.com>

Author: azurelinux-security

SPECS/sqlite/CVE-2026-11822.patch

@@ -0,0 +1,27 @@
+From b519476d3832b7207777d6e45862724a00167036 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Thu, 11 Jun 2026 05:12:21 +0000
+Subject: [PATCH] Fix potential buffer overwrite in fts5 corrupt leaf handling
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/sqlite/sqlite/commit/79db323ce14923a1bcc7b3b72679003c14c1cd7f.patch
+---
+ sqlite3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index dd0c5f4..3520a8d 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -237152,7 +237152,7 @@ static void fts5DataRelease(Fts5Data *pData){
+ static Fts5Data *fts5LeafRead(Fts5Index *p, i64 iRowid){
+   Fts5Data *pRet = fts5DataRead(p, iRowid);
+   if( pRet ){
+-    if( pRet->nn<4 || pRet->szLeaf>pRet->nn ){
++    if( pRet->szLeaf<4 || pRet->szLeaf>pRet->nn ){
+       p->rc = FTS5_CORRUPT;
+       fts5DataRelease(pRet);
+       pRet = 0;
+-- 
+2.45.4
+

SPECS/sqlite/CVE-2026-11824.nopatch

@@ -0,0 +1 @@
+# Fixed as part of CVE-2026-11822

SPECS/sqlite/sqlite.spec

@@ -2,7 +2,7 @@
 Summary:        A portable, high level programming interface to various calling conventions
 Name:           sqlite
 Version:        3.44.0
-Release:        3%{?dist}
+Release:        4%{?dist}
 License:        Public Domain
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -13,6 +13,7 @@ Source0:        https://www.sqlite.org/2023/%{name}-autoconf-%{sourcever}.tar.gz
 Patch0:         CVE-2015-3717.nopatch
 Patch1:         CVE-2025-6965.patch
 Patch2:         CVE-2025-70873.patch
+Patch3:         CVE-2026-11822.patch
 Requires:       sqlite-libs = %{version}-%{release}
 Provides:       sqlite3
 
@@ -83,6 +84,9 @@ make %{?_smp_mflags} check
 %{_libdir}/libsqlite3.so.0.8.6
 
 %changelog
+* Thu Jun 11 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.44.0-4
+- Patch for CVE-2026-11822
+
 * Fri Apr 17 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.44.0-3
 - Patch for CVE-2025-70873
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -88,9 +88,9 @@ bison-3.8.2-1.azl3.aarch64.rpm
 popt-1.19-1.azl3.aarch64.rpm
 popt-devel-1.19-1.azl3.aarch64.rpm
 popt-lang-1.19-1.azl3.aarch64.rpm
-sqlite-3.44.0-3.azl3.aarch64.rpm
-sqlite-devel-3.44.0-3.azl3.aarch64.rpm
-sqlite-libs-3.44.0-3.azl3.aarch64.rpm
+sqlite-3.44.0-4.azl3.aarch64.rpm
+sqlite-devel-3.44.0-4.azl3.aarch64.rpm
+sqlite-libs-3.44.0-4.azl3.aarch64.rpm
 elfutils-0.189-6.azl3.aarch64.rpm
 elfutils-default-yama-scope-0.189-6.azl3.noarch.rpm
 elfutils-devel-0.189-6.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -88,9 +88,9 @@ bison-3.8.2-1.azl3.x86_64.rpm
 popt-1.19-1.azl3.x86_64.rpm
 popt-devel-1.19-1.azl3.x86_64.rpm
 popt-lang-1.19-1.azl3.x86_64.rpm
-sqlite-3.44.0-3.azl3.x86_64.rpm
-sqlite-devel-3.44.0-3.azl3.x86_64.rpm
-sqlite-libs-3.44.0-3.azl3.x86_64.rpm
+sqlite-3.44.0-4.azl3.x86_64.rpm
+sqlite-devel-3.44.0-4.azl3.x86_64.rpm
+sqlite-libs-3.44.0-4.azl3.x86_64.rpm
 elfutils-0.189-6.azl3.x86_64.rpm
 elfutils-default-yama-scope-0.189-6.azl3.noarch.rpm
 elfutils-devel-0.189-6.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -574,10 +574,10 @@ sed-lang-4.9-2.azl3.aarch64.rpm
 slang-2.3.3-1.azl3.aarch64.rpm
 slang-debuginfo-2.3.3-1.azl3.aarch64.rpm
 slang-devel-2.3.3-1.azl3.aarch64.rpm
-sqlite-3.44.0-3.azl3.aarch64.rpm
-sqlite-debuginfo-3.44.0-3.azl3.aarch64.rpm
-sqlite-devel-3.44.0-3.azl3.aarch64.rpm
-sqlite-libs-3.44.0-3.azl3.aarch64.rpm
+sqlite-3.44.0-4.azl3.aarch64.rpm
+sqlite-debuginfo-3.44.0-4.azl3.aarch64.rpm
+sqlite-devel-3.44.0-4.azl3.aarch64.rpm
+sqlite-libs-3.44.0-4.azl3.aarch64.rpm
 swig-4.2.1-1.azl3.aarch64.rpm
 swig-debuginfo-4.2.1-1.azl3.aarch64.rpm
 systemd-bootstrap-250.3-19.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -582,10 +582,10 @@ sed-lang-4.9-2.azl3.x86_64.rpm
 slang-2.3.3-1.azl3.x86_64.rpm
 slang-debuginfo-2.3.3-1.azl3.x86_64.rpm
 slang-devel-2.3.3-1.azl3.x86_64.rpm
-sqlite-3.44.0-3.azl3.x86_64.rpm
-sqlite-debuginfo-3.44.0-3.azl3.x86_64.rpm
-sqlite-devel-3.44.0-3.azl3.x86_64.rpm
-sqlite-libs-3.44.0-3.azl3.x86_64.rpm
+sqlite-3.44.0-4.azl3.x86_64.rpm
+sqlite-debuginfo-3.44.0-4.azl3.x86_64.rpm
+sqlite-devel-3.44.0-4.azl3.x86_64.rpm
+sqlite-libs-3.44.0-4.azl3.x86_64.rpm
 swig-4.2.1-1.azl3.x86_64.rpm
 swig-debuginfo-4.2.1-1.azl3.x86_64.rpm
 systemd-bootstrap-250.3-19.azl3.x86_64.rpm