p PatchFirst

CVE-2018-20506

CVE-2018-20506

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

CVSS 8.1 · High · EPSS 7.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • sqlite3 Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.25.3-1

    Update to 3.25.3-1

  • sqlite3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.25.3-1

    Update to 3.25.3-1

  • sqlite3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.25.3-1

    Update to 3.25.3-1

  • sqlite3 Ubuntu:Pro:14.04:LTS

    Versions
    • 3.7.17-1ubuntu1
    • 3.8.0.2-1ubuntu1
    • 3.8.1-1ubuntu1
    • 3.8.1-1ubuntu3
    • 3.8.2-1ubuntu1
    • 3.8.2-1ubuntu2
    • 3.8.2-1ubuntu2.1
    • 3.8.2-1ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 3.8.2-1ubuntu2.2+esm1

    Update to 3.8.2-1ubuntu2.2+esm1

  • sqlite3 Ubuntu:16.04:LTS

    Versions
    • 3.8.11.1-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.2-1
    • 3.11.0-1ubuntu1
    • 3.11.0-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 3.11.0-1ubuntu1.2

    Update to 3.11.0-1ubuntu1.2

  • sqlite3 Ubuntu:18.04:LTS

    Versions
    • 3.19.3-3
    • 3.20.1-2
    • 3.21.0-1
    • 3.22.0-1
    Affected ranges
    • ECOSYSTEM: < 3.22.0-1ubuntu0.1

    Update to 3.22.0-1ubuntu0.1

Original sources

Check your server →