High severity8.1OSV Advisory· Published Dec 21, 2018· Updated Jun 17, 2026
CVE-2018-20346
CVE-2018-20346
Description
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
42- osv-coords34 versionspkg:rpm/opensuse/sqlite3&distro=openSUSE%20Leap%2015.0pkg:rpm/suse/sqlite3&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/sqlite3&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/sqlite3&distro=SUSE%20Studio%20Onsite%201.3
< 3.27.2-lp150.2.3.1+ 33 more
- (no CPE)range: < 3.27.2-lp150.2.3.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.27.2-3.3.2
- (no CPE)range: < 3.7.6.3-1.4.7.3.1
- (no CPE)range: < 3.7.6.3-1.4.7.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.8.3.1-2.7.1
- (no CPE)range: < 3.7.6.3-1.4.7.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.7.6.3-1.4.7.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.7.6.3-1.4.7.3.1
Patches
Vulnerability mechanics
References
33- sqlite.org/src/info/940f2adc8541a838nvdPatchThird Party Advisory
- sqlite.org/src/info/d44318f59044162envdPatchThird Party Advisory
- github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.htmlnvdExploitThird Party Advisory
- worthdoingbadly.com/sqlitebug/nvdExploitThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.htmlnvdThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.htmlnvdMailing ListThird Party Advisory
- www.securityfocus.com/bid/106323nvdThird Party AdvisoryVDB Entry
- access.redhat.com/articles/3758321nvdThird Party Advisory
- blade.tencent.com/magellan/index_en.htmlnvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
- chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.htmlnvdThird Party Advisory
- chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786envdThird Party Advisory
- crbug.com/900910nvdPermissions RequiredThird Party Advisory
- lists.debian.org/debian-lts-announce/2018/12/msg00012.htmlnvdMailing ListThird Party Advisory
- news.ycombinator.com/itemnvdThird Party Advisory
- security.gentoo.org/glsa/201904-21nvdThird Party Advisory
- www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.ascnvdThird Party Advisory
- www.sqlite.org/releaselog/3_25_3.htmlnvdRelease NotesVendor Advisory
- www.synology.com/security/advisory/Synology_SA_18_61nvdThird Party Advisory
- kc.mcafee.com/corporate/indexnvd
- lists.debian.org/debian-lts-announce/2020/08/msg00037.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/nvd
- support.apple.com/HT209443nvd
- support.apple.com/HT209446nvd
- support.apple.com/HT209447nvd
- support.apple.com/HT209448nvd
- support.apple.com/HT209450nvd
- support.apple.com/HT209451nvd
- usn.ubuntu.com/4019-1/nvd
- usn.ubuntu.com/4019-2/nvd
- www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.htmlnvd
- www.oracle.com/security-alerts/cpuapr2020.htmlnvd
News mentions
1- ABB B&R Automation StudioCISA ICS Advisories