SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sqlite | Jan 3, 2019 | Dec 21, 2018 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Jan 25, 2019 | Jan 24, 2019 |
| Apple Osx Sqlite | — | Upgrade macOS to the latest version | Jan 23, 2019 | Dec 21, 2018 |
| Debian | — | Upgrade chromiumUpgrade sqlite3 | Feb 20, 2019 | Dec 21, 2018 |
| Gentoo Linux | — | Upgrade dev-db/sqlite. | Apr 24, 2019 | Dec 21, 2018 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Dec 3, 2019 | Dec 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sqliteUpgrade sqlite-devel | Sep 12, 2019 | Dec 21, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade sqlite-develUpgrade sqlite | Mar 27, 2019 | Dec 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sqlite-develUpgrade sqlite | Apr 3, 2019 | Dec 21, 2018 |
| Suse | — | Upgrade sqlite3-develUpgrade sqlite3Upgrade libsqlite3-0-x86Upgrade libsqlite3-0-32bitUpgrade libsqlite3-0Upgrade sqlite3-doc | Apr 1, 2019 | Dec 21, 2018 |
| Ubuntu | — | Upgrade libsqlite3-0Upgrade libsqlite3-0 (Ubuntu Pro)Upgrade sqlite3 (Ubuntu Pro)Upgrade sqlite3 | Jun 20, 2019 | Dec 21, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub