CVE-2018-20506

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

CVSS v3.0 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3.0 : HIGH

V3 Legend

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://support.apple.com/kb/HT209451	Third Party Advisory
https://support.apple.com/kb/HT209450	Third Party Advisory
https://support.apple.com/kb/HT209448	Third Party Advisory
https://support.apple.com/kb/HT209447	Third Party Advisory
https://support.apple.com/kb/HT209446	Third Party Advisory
https://support.apple.com/kb/HT209443	Third Party Advisory
https://sqlite.org/src/info/940f2adc8541a838	Vendor Advisory
https://seclists.org/bugtraq/2019/Jan/39	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/33	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/32	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/31	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/29	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/28	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/106698	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/Jan/69	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jan/68	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jan/67	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jan/66	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jan/64	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jan/62	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20190502-0004/	Third Party Advisory
https://usn.ubuntu.com/4019-1/
https://usn.ubuntu.com/4019-2/
https://www.oracle.com/security-alerts/cpuapr2020.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:mac_os_x::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:watchos::::::::

Configuration 3 (hide)

AND

OR	cpe:2.3:a:apple:icloud::::::::
	cpe:2.3:a:apple:itunes::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

Information

Published : 2019-04-03 11:29

Updated : 2021-07-31 01:15

NVD link : CVE-2018-20506

Mitre link : CVE-2018-20506

JSON object : View

CWE

CWE-190

Integer Overflow or Wraparound

Products Affected

apple

itunes
tvos
icloud
mac_os_x
watchos
iphone_os

microsoft

windows

sqlite

sqlite

opensuse

leap

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://support.apple.com/kb/HT209451", "name": "https://support.apple.com/kb/HT209451", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://support.apple.com/kb/HT209450", "name": "https://support.apple.com/kb/HT209450", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://support.apple.com/kb/HT209448", "name": "https://support.apple.com/kb/HT209448", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://support.apple.com/kb/HT209447", "name": "https://support.apple.com/kb/HT209447", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://support.apple.com/kb/HT209446", "name": "https://support.apple.com/kb/HT209446", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://support.apple.com/kb/HT209443", "name": "https://support.apple.com/kb/HT209443", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://sqlite.org/src/info/940f2adc8541a838", "name": "https://sqlite.org/src/info/940f2adc8541a838", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://seclists.org/bugtraq/2019/Jan/39", "name": "https://seclists.org/bugtraq/2019/Jan/39", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://seclists.org/bugtraq/2019/Jan/33", "name": "https://seclists.org/bugtraq/2019/Jan/33", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://seclists.org/bugtraq/2019/Jan/32", "name": "https://seclists.org/bugtraq/2019/Jan/32", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://seclists.org/bugtraq/2019/Jan/31", "name": "https://seclists.org/bugtraq/2019/Jan/31", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://seclists.org/bugtraq/2019/Jan/29", "name": "https://seclists.org/bugtraq/2019/Jan/29", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://seclists.org/bugtraq/2019/Jan/28", "name": "https://seclists.org/bugtraq/2019/Jan/28", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/106698", "name": "http://www.securityfocus.com/bid/106698", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Jan/69", "name": "http://seclists.org/fulldisclosure/2019/Jan/69", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Jan/68", "name": "http://seclists.org/fulldisclosure/2019/Jan/68", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Jan/67", "name": "http://seclists.org/fulldisclosure/2019/Jan/67", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Jan/66", "name": "http://seclists.org/fulldisclosure/2019/Jan/66", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Jan/64", "name": "http://seclists.org/fulldisclosure/2019/Jan/64", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Jan/62", "name": "http://seclists.org/fulldisclosure/2019/Jan/62", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html", "name": "openSUSE-SU-2019:1222", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "SUSE"}, {"url": "https://security.netapp.com/advisory/ntap-20190502-0004/", "name": "https://security.netapp.com/advisory/ntap-20190502-0004/", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://usn.ubuntu.com/4019-1/", "name": "USN-4019-1", "tags": [], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/4019-2/", "name": "USN-4019-2", "tags": [], "refsource": "UBUNTU"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2020.html", "name": "N/A", "tags": [], "refsource": "N/A"}, {"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html", "name": "[debian-lts-announce] 20200822 [SECURITY] [DLA 2340-1] sqlite3 security update", "tags": [], "refsource": "MLIST"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10365", "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10365", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-190"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-20506", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}}, "publishedDate": "2019-04-03T18:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.25.3"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "12.1.3"}, {"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "10.14.3"}, {"cpe23Uri": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "12.1.2"}, {"cpe23Uri": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.1.3"}]}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.10"}, {"cpe23Uri": "cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "12.9.3"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-07-31T08:15Z"}

8.1 /10