CVE-2018-20346

EUVD-2018-12904
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
sqlitesqlite
𝑥
< 3.25.3
googlechrome
𝑥
< 71.0.3578.80
redhatlinux
6.0
debiandebian_linux
8.0
opensuseleap
15.0
opensuseleap
42.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
chromium
bookworm
128.0.6613.84-1~deb12u1
fixed
bookworm (security)
130.0.6723.91-1~deb12u1
fixed
bullseye
120.0.6099.224-1~deb11u1
fixed
bullseye (security)
120.0.6099.224-1~deb11u1
fixed
sid
130.0.6723.91-2
fixed
trixie
129.0.6668.89-1
fixed
sqlite3
bookworm
3.40.1-2
fixed
bullseye
3.34.1-3
fixed
bullseye (security)
3.34.1-3+deb11u1
fixed
sid
3.46.1-1
fixed
trixie
3.46.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium
bionic
dne
cosmic
dne
disco
dne
trusty
dne
xenial
dne
sqlite3
bionic
Fixed 3.22.0-1ubuntu0.1
released
cosmic
Fixed 3.24.0-1ubuntu0.1
released
disco
not-affected
trusty
Fixed 3.8.2-1ubuntu2.2+esm1
released
xenial
Fixed 3.11.0-1ubuntu1.2
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
http://www.securityfocus.com/bid/106323
https://access.redhat.com/articles/3758321
https://blade.tencent.com/magellan/index_en.html
https://bugzilla.redhat.com/show_bug.cgi?id=1659379
https://bugzilla.redhat.com/show_bug.cgi?id=1659677
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e
https://crbug.com/900910
https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
https://news.ycombinator.com/item?id=18685296
https://security.gentoo.org/glsa/201904-21
https://sqlite.org/src/info/940f2adc8541a838
https://sqlite.org/src/info/d44318f59044162e
https://support.apple.com/HT209443
https://support.apple.com/HT209446
https://support.apple.com/HT209447
https://support.apple.com/HT209448
https://support.apple.com/HT209450
https://support.apple.com/HT209451
https://usn.ubuntu.com/4019-1/
https://usn.ubuntu.com/4019-2/
https://worthdoingbadly.com/sqlitebug/
https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc
https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.sqlite.org/releaselog/3_25_3.html
https://www.synology.com/security/advisory/Synology_SA_18_61
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
http://www.securityfocus.com/bid/106323
https://access.redhat.com/articles/3758321
https://blade.tencent.com/magellan/index_en.html
https://bugzilla.redhat.com/show_bug.cgi?id=1659379
https://bugzilla.redhat.com/show_bug.cgi?id=1659677
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e
https://crbug.com/900910
https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
https://news.ycombinator.com/item?id=18685296
https://security.gentoo.org/glsa/201904-21
https://sqlite.org/src/info/940f2adc8541a838
https://sqlite.org/src/info/d44318f59044162e
https://support.apple.com/HT209443
https://support.apple.com/HT209446
https://support.apple.com/HT209447
https://support.apple.com/HT209448
https://support.apple.com/HT209450
https://support.apple.com/HT209451
https://usn.ubuntu.com/4019-1/
https://usn.ubuntu.com/4019-2/
https://worthdoingbadly.com/sqlitebug/
https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc
https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.sqlite.org/releaselog/3_25_3.html
https://www.synology.com/security/advisory/Synology_SA_18_61