Has GOG Galaxy been patched yet to get rid of old versions of SQLite in its installation, and eradicate this vulnerability ?

https://www.slashgear.com/sqlite-magellan-bug-affects-chrome-based-browsers-thousands-of-apps-16558106/



Directory of C:\Program Files (x86)\GOG Galaxy

13/12/2018 15:08 681,032 sqlite.dll
1 File(s) 681,032 bytes

Directory of C:\ProgramData\GOG.com\Galaxy\redists

13/12/2018 15:07 681,032 sqlite.dll
1 File(s) 681,032 bytes

Directory of C:\ProgramData\GOG.com\Galaxy\temp\desktop-galaxy-updater

13/12/2018 15:07 681,032 sqlite.dll
1 File(s) 681,032 bytes

Directory of C:\Users\All Users\GOG.com\Galaxy\redists

13/12/2018 15:07 681,032 sqlite.dll
1 File(s) 681,032 bytes

Directory of C:\Users\All Users\GOG.com\Galaxy\temp\desktop-galaxy-updater

13/12/2018 15:07 681,032 sqlite.dll
1 File(s) 681,032 bytes

How should we know? We're not devs and file sizes won't tell us jack squat.

Does Galaxy even allow you to visit other websites aside from gog.com ? If not, how is a potential attacker supposed to exploit this bug?

I don't think so, but even if it can only load GOG.com, it may still be dangerous. I seem to remember that there was an issue with script injections in the community wishlist and given how laissez-faire GOG has been with the website, I don't find it a very remote possibility that another such bug would exist somewhere on the ‮:etis

I have also submitted a support request, pointing the devs here at this topic if they wish to assure everyone publicly that they know about it and any measures being / needing done.

I think its a question needs answered and preferably for all of us publicly, not just to satisfy my own private question to GOG support.

And its not like the information is not public already, just google SQLite Magellan

Well, more informative would be the SHA fingerprints.

Thank you Cwaniak, I am happy for the support ticket to be closed now the developers are on it (I forgot to tick the little box which says close the issue).

Happy holidays.