diff --git a/0001-CVE-2023-7104.patch b/0001-CVE-2023-7104.patch
new file mode 100644
index 0000000000000000000000000000000000000000..bded7fdbff8ddeed4a42241e24c42dd07bb837f0
--- /dev/null
+++ b/0001-CVE-2023-7104.patch
@@ -0,0 +1,45 @@
+it From a756d158b3e55831975feb45b753ba499d2adeda Mon Sep 17 00:00:00 2001
+From: mazhao <mazhao12@huawei.com>
+Date: Wed, 3 Jan 2024 12:00:45 +0800
+Subject: [PATCH] Fix a buffer overread in the sessions extension that could
+ occur when processing a corrupt changeset.
+
+Signed-off-by: mazhao <mazhao12@huawei.com>
+---
+ ext/session/sqlite3session.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
+index a892804..72ad427 100644
+--- a/ext/session/sqlite3session.c
++++ b/ext/session/sqlite3session.c
+@@ -3050,15 +3050,19 @@ static int sessionReadRecord(
+         }
+       }
+       if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
+-        sqlite3_int64 v = sessionGetI64(aVal);
+-        if( eType==SQLITE_INTEGER ){
+-          sqlite3VdbeMemSetInt64(apOut[i], v);
++        if( (pIn->nData-pIn->iNext)<8 ){
++          rc = SQLITE_CORRUPT_BKPT;
+         }else{
+-          double d;
+-          memcpy(&d, &v, 8);
+-          sqlite3VdbeMemSetDouble(apOut[i], d);
++          sqlite3_int64 v = sessionGetI64(aVal);
++          if( eType==SQLITE_INTEGER ){
++            sqlite3VdbeMemSetInt64(apOut[i], v);
++          }else{
++            double d;
++            memcpy(&d, &v, 8);
++            sqlite3VdbeMemSetDouble(apOut[i], d);
++          }
++          pIn->iNext += 8;
+         }
+-        pIn->iNext += 8;
+       }
+     }
+   }
+-- 
+2.34.1
+
diff --git a/sqlite.spec b/sqlite.spec
index 7fd324b18522722a612aff76c6b9f03d83a71761..90c6e5f636a86729f09c6a12967ae894eb8bfe38 100644
--- a/sqlite.spec
+++ b/sqlite.spec
@@ -6,7 +6,7 @@
 
 Name:    sqlite
 Version: 3.42.0
-Release: 1
+Release: 2
 Summary: Embeded SQL database
 License: Public Domain
 URL:     http://www.sqlite.org/
@@ -15,6 +15,8 @@ Source0: https://www.sqlite.org/2023/sqlite-src-%{extver}.zip
 Source1: http://www.sqlite.org/2023/sqlite-doc-%{extver}.zip
 Source2: https://www.sqlite.org/2023/sqlite-autoconf-%{extver}.tar.gz
 
+Patch1: 0001-CVE-2023-7104.patch
+
 BuildRequires: gcc autoconf tcl tcl-devel
 BuildRequires: ncurses-devel readline-devel glibc-devel
 
@@ -56,6 +58,7 @@ This contains man files and HTML files for the using of sqlite.
 %prep
 #autosetup will fail because of 2 zip files
 %setup -q -a1 -n %{name}-src-%{extver}
+%patch1 -p1
 
 rm -f %{name}-doc-%{extver}/sqlite.css~ || :
 
@@ -130,6 +133,9 @@ make test
 %{_mandir}/man*/*
 
 %changelog
+* Wed Sep 4 2024 wangmian <wangmian19@h-partners.com> - 3.42.0-2
+- sync the CVE-2023-7104 from 2203
+
 * Tue Feb 27 2024 Zheng Zhenyu <zheng.zhenyu@outlook.com> - 3.42.0-1
 - Bump version to fix CVE-2024-0232