CVE-2018-20346

Published: Dec 21, 2018Modified: Nov 21, 2024

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

Affected (6)

Products: Sqlite: Sqlite · Google: Chrome · Redhat: Linux · +2 more

Show all products

Sqlite: Sqlite · Google: Chrome · Redhat: Linux · Debian: Debian Linux · Opensuse: Leap

1 product

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sqlite Sqlite	Before 3.25.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 71.0.3578.80

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Linux	Version 6.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 42.3

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (66)

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/106323

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/articles/3758321

Source: cve@mitre.org

Third Party Advisory

https://blade.tencent.com/magellan/index_en.html

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1659379

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1659677

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html

Source: cve@mitre.org

Third Party Advisory

https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e

Source: cve@mitre.org

Third Party Advisory

https://crbug.com/900910

Source: cve@mitre.org

Permissions RequiredThird Party Advisory

https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/

Source: cve@mitre.org

https://news.ycombinator.com/item?id=18685296

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/201904-21

Source: cve@mitre.org

Third Party Advisory

https://sqlite.org/src/info/940f2adc8541a838

Source: cve@mitre.org

PatchThird Party Advisory

https://sqlite.org/src/info/d44318f59044162e

Source: cve@mitre.org

PatchThird Party Advisory

https://support.apple.com/HT209443

Source: cve@mitre.org

https://support.apple.com/HT209446

Source: cve@mitre.org

https://support.apple.com/HT209447

Source: cve@mitre.org

https://support.apple.com/HT209448

Source: cve@mitre.org

https://support.apple.com/HT209450

Source: cve@mitre.org

https://support.apple.com/HT209451

Source: cve@mitre.org

https://usn.ubuntu.com/4019-1/

Source: cve@mitre.org

https://usn.ubuntu.com/4019-2/

Source: cve@mitre.org

https://worthdoingbadly.com/sqlitebug/

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc

Source: cve@mitre.org

Third Party Advisory

https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

https://www.sqlite.org/releaselog/3_25_3.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.synology.com/security/advisory/Synology_SA_18_61

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html