Description:
------------
from what i understand, your fix for the above mentioned vulnerabilities was to patch the bundled sqlite libraries to handle certain parameters that might be null pointers.   however, for distributions where php is built against external sqlite packages, this  has no effect and the resulting packages are still vulnerable unless the sqlite packages are independantly patched.

in the debian php packages, we've patched the php_sqlite module to check for the null pointers outside of the call to the sqlite functions, thus not requiring a patch or change in the behaviour of the sqlite libraries.

anyway, if you want to continue keeping a patched bundled version of sqlite, that's fine, but i thought i'd share this.