CVE-2018-20346: debian debian_linux Integer Overflow or Wraparound

Modified

AliasesALPINE-CVE-2018-20346MGASA-2018-0489SUSE-SU-2019:0788-1+4 more

Published 21-12-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-20346 is a high (CVSS 8.1) Integer Overflow or Wraparound vulnerability in debian debian_linux. EPSS estimates a 10.23% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

8.1/10

010

High · v3.0 (NVD)

EPSS score

10.23%

0%100%

Medium · -0.08 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 8 · Related 5

DLA-1613-1 DLA-2340-1 DSA-4352-1 SUSE-SU-2019:0913-1 SUSE-SU-2019:0973-1 SUSE-SU-2021:3215-1+2 more

Timeline

21-12-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.08.1v2.06.8

EPSS trend

Probability

10.23%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Decrease -0.08 pp

From 10.31% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

githubUnverified
Worthdoingbadly.Com
Maturity: poc
referenceUnverified
Exploit Reference (worthdoingbadly.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse6 products

sqlite3&distro=SUSE Linux Enterprise Module for Basesystem 15< 3.27.2-3.3.2
sqlite3&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.7.6.3-1.4.7.3.1
sqlite3&distro=SUSE Linux Enterprise Server 11 SP4< 3.7.6.3-1.4.7.3.1
sqlite3&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 3.7.6.3-1.4.7.3.1
sqlite3&distro=SUSE Linux Enterprise Software Development Kit 11 SP4< 3.7.6.3-1.4.7.3.1

Show all 6

Debian3 products

chromium< 71.0.3578.80-1
sqlite3< 3.25.3-1
debian_linuxEOL8.0

Opensuse2 products

leapEOL15.0 | 42.3
sqlite3&distro=openSUSE Leap 15.0< 3.27.2-lp150.2.3.1

Alpine1 product

sqlite< 3.25.3-r0

Google1 product

chrome< 71.0.3578.80

Mageia1 product

sqlite3< 3.25.3-1.mga6

Redhat1 product

linux6.0

Sqlite1 product

sqlite< 3.25.3

Ubuntu1 product

sqlite3< 3.8.2-1ubuntu2.2+esm1 | < 3.11.0-1ubuntu1.2 | < 3.22.0-1ubuntu0.1

9 vendors · 17 products

References

50 links

worthdoingbadly.com/sqlitebug/X Refsource MISCExploitThird Party AdvisoryREPORT
support.apple.com/HT209446X Refsource CONFIRM
bugzilla.redhat.com/show_bug.cgi?id=1659379X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
bugzilla.redhat.com/show_bug.cgi?id=1659677X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
lists.debian.org/debian-lts-announce/2018/12/msg00012.htmlMailing ListX Refsource MLISTThird Party AdvisoryREPORT
www.synology.com/security/advisory/Synology_SA_18_61X Refsource CONFIRMThird Party Advisory
access.redhat.com/articles/3758321X Refsource MISCThird Party AdvisoryREPORT
support.apple.com/HT209443X Refsource CONFIRM
blade.tencent.com/magellan/index_en.htmlX Refsource MISCThird Party AdvisoryREPORT
support.apple.com/HT209451X Refsource CONFIRM

Show all 50 references

github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.htmlX Refsource MISCExploitThird Party AdvisoryREPORT
news.ycombinator.com/item?id=18685296X Refsource MISCThird Party AdvisoryREPORT
support.apple.com/HT209450X Refsource CONFIRM
sqlite.org/src/info/940f2adc8541a838X Refsource MISCPatchThird Party AdvisoryREPORT
support.apple.com/HT209448X Refsource CONFIRM
chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786eX Refsource MISCThird Party AdvisoryREPORT
www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.htmlX Refsource MISC
www.securityfocus.com/bid/106323VDB EntryX Refsource BIDThird Party Advisory
crbug.com/900910X Refsource MISCPermissions RequiredThird Party AdvisoryREPORT
sqlite.org/src/info/d44318f59044162eX Refsource MISCPatchThird Party AdvisoryREPORT
www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.htmlX Refsource MISCThird Party AdvisoryREPORT
www.sqlite.org/releaselog/3_25_3.htmlX Refsource MISCRelease NotesVendor AdvisoryREPORT
support.apple.com/HT209447X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
security.gentoo.org/glsa/201904-21Vendor AdvisoryX Refsource GENTOOThird Party Advisory
usn.ubuntu.com/4019-1/Vendor AdvisoryX Refsource UBUNTU
usn.ubuntu.com/4019-2/Vendor AdvisoryX Refsource UBUNTU
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISC
lists.debian.org/debian-lts-announce/2020/08/msg00037.htmlMailing ListX Refsource MLIST
kc.mcafee.com/corporate/index?page=content&id=SB10365X Refsource CONFIRM
security.alpinelinux.org/vuln/CVE-2018-20346Advisory
advisories.mageia.org/MGASA-2018-0489.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=24045REPORT
www.openwall.com/lists/oss-security/2018/12/21/1WEB
lists.fedoraproject.org/archives/…WEB
www.suse.com/support/update/announcement/2019/suse-su-20190788-1/Advisory
bugzilla.suse.com/1119687REPORT
www.suse.com/security/cve/CVE-2018-20346WEB
www.suse.com/support/update/announcement/2019/suse-su-201914003-1/Advisory
ubuntu.com/security/CVE-2018-20346REPORT
www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.htmlREPORT
ubuntu.com/security/notices/USN-4019-1Advisory
ubuntu.com/security/notices/USN-4019-2Advisory
www.cve.org/CVERecord?id=CVE-2018-20346REPORT
security-tracker.debian.org/tracker/CVE-2018-20346Advisory
lists.opensuse.org/archives/…Advisory
nvd.nist.gov/vuln/detail/CVE-2018-20346OvalAdvisory