High severity8.1OSV Advisory· Published Apr 3, 2019· Updated Jun 17, 2026

CVE-2018-20506

Description

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SQLite/SQLiteOSV3 versions
version-1.0, version-1.0.1, version-1.0.10, …+ 2 more
- (no CPE)range: version-1.0, version-1.0.1, version-1.0.10, …
- cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*range: <3.25.3
- (no CPE)range: <3.25.3
Apple Inc./iCloud
cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*
Range: <=7.10
Apple Inc./iTunes
cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*
Range: <=12.9.3
Apple Inc./Iphone OS
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Range: <12.1.3
Apple Inc./Mac OS X
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Range: <10.14.3
Apple Inc./tvOS
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Range: <12.1.2
Apple Inc./watchOS
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Range: <5.1.3
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
osv-coords16 versions
pkg:rpm/suse/sqlite3&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%207
< 3.8.10.2-9.3.1+ 15 more
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.3.1-2.7.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1
- (no CPE)range: < 3.8.10.2-9.3.1

Patches

Vulnerability mechanics

References

lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.htmlnvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Jan/62nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Jan/64nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Jan/66nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Jan/67nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Jan/68nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Jan/69nvdMailing ListThird Party Advisory
www.securityfocus.com/bid/106698nvdThird Party AdvisoryVDB Entry
seclists.org/bugtraq/2019/Jan/28nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Jan/29nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Jan/31nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Jan/32nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Jan/33nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Jan/39nvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20190502-0004/nvdThird Party Advisory
sqlite.org/src/info/940f2adc8541a838nvdVendor Advisory
support.apple.com/kb/HT209443nvdThird Party Advisory
support.apple.com/kb/HT209446nvdThird Party Advisory
support.apple.com/kb/HT209447nvdThird Party Advisory
support.apple.com/kb/HT209448nvdThird Party Advisory
support.apple.com/kb/HT209450nvdThird Party Advisory
support.apple.com/kb/HT209451nvdThird Party Advisory
kc.mcafee.com/corporate/indexnvd
lists.debian.org/debian-lts-announce/2020/08/msg00037.htmlnvd
usn.ubuntu.com/4019-1/nvd
usn.ubuntu.com/4019-2/nvd
www.oracle.com/security-alerts/cpuapr2020.htmlnvd

News mentions

ABB B&R Automation Studio
CISA ICS Advisories

cvss	0.526
epss	0.006
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000