CVE-2018-20346

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
VendorProductVersion
sqlitesqlite
𝑥
< 3.25.3
googlechrome
𝑥
< 71.0.3578.80
redhatlinux
6.0
debiandebian_linux
8.0
opensuseleap
15.0
opensuseleap
42.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
chromium
bullseye (security)
120.0.6099.224-1~deb11u1
fixed
bullseye
120.0.6099.224-1~deb11u1
fixed
bookworm
128.0.6613.84-1~deb12u1
fixed
bookworm (security)
130.0.6723.91-1~deb12u1
fixed
trixie
129.0.6668.89-1
fixed
sid
130.0.6723.91-2
fixed
sqlite3
bullseye
3.34.1-3
fixed
bullseye (security)
3.34.1-3+deb11u1
fixed
bookworm
3.40.1-2
fixed
sid
3.46.1-1
fixed
trixie
3.46.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
sqlite3
disco
not-affected
cosmic
Fixed 3.24.0-1ubuntu0.1
released
bionic
Fixed 3.22.0-1ubuntu0.1
released
xenial
Fixed 3.11.0-1ubuntu1.2
released
trusty
Fixed 3.8.2-1ubuntu2.2+esm1
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
http://www.securityfocus.com/bid/106323
https://access.redhat.com/articles/3758321
https://blade.tencent.com/magellan/index_en.html
https://bugzilla.redhat.com/show_bug.cgi?id=1659379
https://bugzilla.redhat.com/show_bug.cgi?id=1659677
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e
https://crbug.com/900910
https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
https://news.ycombinator.com/item?id=18685296
https://security.gentoo.org/glsa/201904-21
https://sqlite.org/src/info/940f2adc8541a838
https://sqlite.org/src/info/d44318f59044162e
https://support.apple.com/HT209443
https://support.apple.com/HT209446
https://support.apple.com/HT209447
https://support.apple.com/HT209448
https://support.apple.com/HT209450
https://support.apple.com/HT209451
https://usn.ubuntu.com/4019-1/
https://usn.ubuntu.com/4019-2/
https://worthdoingbadly.com/sqlitebug/
https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc
https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.sqlite.org/releaselog/3_25_3.html
https://www.synology.com/security/advisory/Synology_SA_18_61
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
http://www.securityfocus.com/bid/106323
https://access.redhat.com/articles/3758321
https://blade.tencent.com/magellan/index_en.html
https://bugzilla.redhat.com/show_bug.cgi?id=1659379
https://bugzilla.redhat.com/show_bug.cgi?id=1659677
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e
https://crbug.com/900910
https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
https://news.ycombinator.com/item?id=18685296
https://security.gentoo.org/glsa/201904-21
https://sqlite.org/src/info/940f2adc8541a838
https://sqlite.org/src/info/d44318f59044162e
https://support.apple.com/HT209443
https://support.apple.com/HT209446
https://support.apple.com/HT209447
https://support.apple.com/HT209448
https://support.apple.com/HT209450
https://support.apple.com/HT209451
https://usn.ubuntu.com/4019-1/
https://usn.ubuntu.com/4019-2/
https://worthdoingbadly.com/sqlitebug/
https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc
https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.sqlite.org/releaselog/3_25_3.html
https://www.synology.com/security/advisory/Synology_SA_18_61