CVE-2018-20506
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
En SQLite, en versiones anteriores a la 3.25.3, cuando está habilitada la extensión FTS3, hay un desbordamiento de enteros que resulta en un desbordamiento de búfer para consultas FTS3 en una operación de unión que ocurre después de que se realicen cambios manipulados en las tablas de sombras de FTS3. Esto permite que atacantes remotos ejecuten código arbitrario, explotando la posibilidad de ejecutar declaraciones SQL arbitrarias (como en ciertos casos de uso de WebSQL). Esta vulnerabilidad es diferente de CVE-2018-20346.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-12-26 CVE Reserved
- 2019-01-23 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-24 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (27)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html | 2021-07-31 | |
https://sqlite.org/src/info/940f2adc8541a838 | 2021-07-31 | |
https://usn.ubuntu.com/4019-1 | 2021-07-31 | |
https://usn.ubuntu.com/4019-2 | 2021-07-31 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Apple Search vendor "Apple" | Icloud Search vendor "Apple" for product "Icloud" | <= 7.10 Search vendor "Apple" for product "Icloud" and version " <= 7.10" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
Apple Search vendor "Apple" | Itunes Search vendor "Apple" for product "Itunes" | <= 12.9.3 Search vendor "Apple" for product "Itunes" and version " <= 12.9.3" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
Sqlite Search vendor "Sqlite" | Sqlite Search vendor "Sqlite" for product "Sqlite" | < 3.25.3 Search vendor "Sqlite" for product "Sqlite" and version " < 3.25.3" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | < 12.1.3 Search vendor "Apple" for product "Iphone Os" and version " < 12.1.3" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | < 10.14.3 Search vendor "Apple" for product "Mac Os X" and version " < 10.14.3" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | < 12.1.2 Search vendor "Apple" for product "Tvos" and version " < 12.1.2" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Watchos Search vendor "Apple" for product "Watchos" | < 5.1.3 Search vendor "Apple" for product "Watchos" and version " < 5.1.3" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 42.3 Search vendor "Opensuse" for product "Leap" and version "42.3" | - |
Affected
|