CVE-2018-20506
Fixed in a distro release EPSS 8%
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
Products: sqlite, apple iphone_os, apple mac_os_x, apple tvos, apple watchos, apple icloud, apple itunes, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sqlite3 | 3.25.3-1 |
| Debian 13 | sqlite3 | 3.25.3-1 |
| Debian 14 | sqlite3 | 3.25.3-1 |
| Debian 8 | sqlite3 | 3.8.7.1-1+deb8u3 |
| Debian 9 | sqlite3 | 3.16.2-5+deb9u2 |
| SUSE Enterprise Storage 4 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server 12 SP3 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server 12 SP4 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server 12-LTSS | sqlite3 | 3.8.3.1-2.7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | sqlite3 | 3.8.10.2-9.3.1 |
| SUSE OpenStack Cloud 7 | sqlite3 | 3.8.10.2-9.3.1 |
| Ubuntu 16.04 LTS | sqlite3 | 3.11.0-1ubuntu1.2 |
| Ubuntu 18.04 LTS | sqlite3 | 3.22.0-1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | sqlite3 | 3.8.2-1ubuntu2.2+esm1 |