VDB
GSD-2018-20506
GSD-2018-20506
PUBLISHED
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
Timeline
- Apr 3, 2009 CVE Published
- Jan 28, 2019 PoC Published
- Mar 31, 2026 Security Advisory
References
- http://seclists.org/fulldisclosure/2019/Jan/62 url
- http://seclists.org/fulldisclosure/2019/Jan/66 url
- http://seclists.org/fulldisclosure/2019/Jan/68 url
- http://seclists.org/fulldisclosure/2019/Jan/69 url
- http://www.securityfocus.com/bid/106698 url
- https://seclists.org/bugtraq/2019/Jan/28 url
- https://seclists.org/bugtraq/2019/Jan/29 url
- https://seclists.org/bugtraq/2019/Jan/31 url
- https://seclists.org/bugtraq/2019/Jan/33 url
- https://seclists.org/bugtraq/2019/Jan/39 url
- https://sqlite.org/src/info/940f2adc8541a838 url
- http://seclists.org/fulldisclosure/2019/Jan/64 url
- http://seclists.org/fulldisclosure/2019/Jan/67 url
- https://seclists.org/bugtraq/2019/Jan/32 url
- openSUSE-SU-2019:1222 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190502-0004/ url
- https://www.oracle.com/security-alerts/cpuapr2020.html url
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365 url
- https://support.apple.com/kb/HT209443 advisory
- https://support.apple.com/kb/HT209451 advisory
…and 7 more