sqlite: Multiple flaws in sqlite which can be triggered via corrupted internal databases (Magellan)
Published Apr 3, 2019
8.1
HIGHCVSS 3.0
EPSS 7.56%
Description
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
Affected products
No data.
Configuration 2
Configuration 3
No data.
Red Hat Enterprise Linux 5
sqlite
Not affected
Red Hat Enterprise Linux 6
sqlite
Not affected
Red Hat Enterprise Linux 7
sqlite
Not affected
Red Hat Enterprise Linux 8
sqlite
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | sqlite | Not affected | n/a |
| Red Hat Enterprise Linux 6 | sqlite | Not affected | n/a |
| Red Hat Enterprise Linux 7 | sqlite | Not affected | n/a |
| Red Hat Enterprise Linux 8 | sqlite | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This flaw does not affect the versions of sqlite package shipped with Red Hat Enterprise Linux 5, 6 and 7. This flaw in sqlite can be exploited by attackers only if they are able to run arbitrary SQL statements on the sqlite database. For more information please see https://bugzilla.redhat.com/show_bug.cgi?id=1659379#c12
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1 other source (Red Hat) ▾
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:N/AC:M/Au:N/C:P/I:P/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (24 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 7.56% (0.07565) | 94.35th | v5 (v2026.06.15) |
| Jun 15, 2026 | 7.53% (0.07531) | 93.70th | v5 (v2026.06.15) |
| May 24, 2026 | 7.89% (0.07888) | 92.12th | v4 (v2025.03.14) |
| May 22, 2026 | 10.83% (0.10826) | 93.45th | v4 (v2025.03.14) |
| Dec 8, 2025 | 8.64% (0.08640) | 92.11th | v4 (v2025.03.14) |
| Nov 21, 2025 | 12.70% (0.12703) | 93.71th | v4 (v2025.03.14) |
| Nov 18, 2025 | 15.21% (0.15214) | 94.01th | v4 (v2025.03.14) |
| Oct 6, 2025 | 12.70% (0.12703) | 93.72th | v4 (v2025.03.14) |
| Oct 3, 2025 | 14.63% (0.14625) | 94.28th | v4 (v2025.03.14) |
| Jun 5, 2025 | 17.97% (0.17974) | 94.80th | v4 (v2025.03.14) |
| Mar 30, 2025 | 13.73% (0.13734) | 93.67th | v4 (v2025.03.14) |
| Mar 29, 2025 | 21.98% (0.21977) | 93.13th | v4 (v2025.03.14) |
| Mar 17, 2025 | 13.73% (0.13734) | 93.75th | v4 (v2025.03.14) |
| Dec 12, 2024 | 1.30% (0.01303) | 86.46th | v3 (v2023.03.01) |
| Mar 27, 2024 | 1.78% (0.01782) | 87.77th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.55% (0.01547) | 85.07th | v3 (v2023.03.01) |
| Mar 6, 2023 | 7.36% (0.07363) | 92.59th | v2 (v2022.01.01) |
| Apr 1, 2022 | 7.36% (0.07363) | 91.87th | v2 (v2022.01.01) |
| Feb 4, 2022 | 7.36% (0.07363) | 80.64th | v2 (v2022.01.01) |
| Feb 3, 2022 | 19.01% (0.19011) | 93.68th | v1 |
| Jan 6, 2022 | 19.01% (0.19011) | 93.61th | v1 |
| Sep 1, 2021 | 19.01% (0.19011) | 97.83th | v1 |
| Jul 31, 2021 | 19.01% (0.19011) | 0.00th | v1 |
| Apr 14, 2021 | 18.45% (0.18453) | 0.00th | v1 |
References (34)
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Jan/62 x_refsource_MISCMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Jan/64 x_refsource_MISCMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Jan/66 x_refsource_MISCMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Jan/67 x_refsource_MISCMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Jan/68 x_refsource_MISCMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Jan/69 x_refsource_MISCMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106698 x_refsource_MISCThird Party AdvisoryVDB Entry
- https://access.redhat.com/articles/3758321
- https://access.redhat.com/security/cve/CVE-2018-20506 Vendor Advisory
- https://blade.tencent.com/magellan/index_en.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1659379 Issue Tracking
- https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365 x_refsource_CONFIRM
- https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2018-20506
- https://seclists.org/bugtraq/2019/Jan/28 x_refsource_MISCMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Jan/29 x_refsource_MISCMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Jan/31 x_refsource_MISCMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Jan/32 x_refsource_MISCMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Jan/33 x_refsource_MISCMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Jan/39 x_refsource_MISCMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0004/ x_refsource_CONFIRMThird Party Advisory
- https://sqlite.org/src/info/940f2adc8541a838 x_refsource_MISCVendor Advisory
- https://support.apple.com/kb/HT209443 x_refsource_MISCThird Party Advisory
- https://support.apple.com/kb/HT209446 x_refsource_MISCThird Party Advisory
- https://support.apple.com/kb/HT209447 x_refsource_MISCThird Party Advisory
- https://support.apple.com/kb/HT209448 x_refsource_MISCThird Party Advisory
- https://support.apple.com/kb/HT209450 x_refsource_MISCThird Party Advisory
- https://support.apple.com/kb/HT209451 x_refsource_MISCThird Party Advisory
- https://usn.ubuntu.com/4019-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/4019-2/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2018-20506
- https://www.oracle.com/security-alerts/cpuapr2020.html x_refsource_MISC
Change history (0)
No recorded changes yet.