{
  "schema_version": "1.4.0",
  "id": "GHSA-wpf6-c3rx-7xrj",
  "modified": "2022-05-13T01:07:38Z",
  "published": "2022-05-13T01:07:38Z",
  "aliases": [
    "CVE-2018-20346"
  ],
  "details": "SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20346"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/security/advisory/Synology_SA_18_61"
    },
    {
      "type": "WEB",
      "url": "https://www.sqlite.org/releaselog/3_25_3.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "type": "WEB",
      "url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html"
    },
    {
      "type": "WEB",
      "url": "https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc"
    },
    {
      "type": "WEB",
      "url": "https://worthdoingbadly.com/sqlitebug"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4019-2"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4019-1"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT209451"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT209450"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT209448"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT209447"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT209446"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT209443"
    },
    {
      "type": "WEB",
      "url": "https://sqlite.org/src/info/d44318f59044162e"
    },
    {
      "type": "WEB",
      "url": "https://sqlite.org/src/info/940f2adc8541a838"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201904-21"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=18685296"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html"
    },
    {
      "type": "WEB",
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10365"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/900910"
    },
    {
      "type": "WEB",
      "url": "https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1659677"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1659379"
    },
    {
      "type": "WEB",
      "url": "https://blade.tencent.com/magellan/index_en.html"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/articles/3758321"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106323"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-12-21T21:29:00Z"
  }
}