Published: 03/04/2019 Updated: 31/07/2021

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 607

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

SQLite prior to 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote malicious users to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sqlite sqlite
apple iphone os
apple mac os x
apple tvos
apple watchos
apple icloud
apple itunes
opensuse leap 42.3

Several security issues were fixed in SQLite ...

Full Disclosure mailing list archives   By Date By Thread </form>    APPLE-SA-2019-1-22-2 macOS Mojave 10143, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra <!--X ...

Full Disclosure mailing list archives   By Date By Thread </form>    APPLE-SA-2019-1-24-1 iTunes 1293 for Windows   From: Apple Prod ...

CWE-190 https://support.apple.com/kb/HT209451 https://support.apple.com/kb/HT209450 https://support.apple.com/kb/HT209448 https://support.apple.com/kb/HT209447 https://support.apple.com/kb/HT209446 https://support.apple.com/kb/HT209443 https://sqlite.org/src/info/940f2adc8541a838 https://seclists.org/bugtraq/2019/Jan/39 https://seclists.org/bugtraq/2019/Jan/33 https://seclists.org/bugtraq/2019/Jan/32 https://seclists.org/bugtraq/2019/Jan/31 https://seclists.org/bugtraq/2019/Jan/29 https://seclists.org/bugtraq/2019/Jan/28 http://www.securityfocus.com/bid/106698 http://seclists.org/fulldisclosure/2019/Jan/69 http://seclists.org/fulldisclosure/2019/Jan/68 http://seclists.org/fulldisclosure/2019/Jan/67 http://seclists.org/fulldisclosure/2019/Jan/66 http://seclists.org/fulldisclosure/2019/Jan/64 http://seclists.org/fulldisclosure/2019/Jan/62 http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html https://security.netapp.com/advisory/ntap-20190502-0004/https://usn.ubuntu.com/4019-1/https://usn.ubuntu.com/4019-2/https://www.oracle.com/security-alerts/cpuapr2020.html https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html https://kc.mcafee.com/corporate/index?page=content&id=SB10365 https://nvd.nist.gov https://usn.ubuntu.com/4019-1/

CVE-2018-20506

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect