CVE-2018-20506
8.1
HIGH
CVSS 3.1
EPSS 8.7%
Description
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
How to fix CVE-2018-20506
To remediate CVE-2018-20506, upgrade the affected package to a fixed version below.
- —upgrade to 3.25.3-1 or later
Is CVE-2018-20506 being exploited?
Moderate — EPSS is 8.7%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- from 0, < 3.25.3-1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |