SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

An update of the sqlite package has been released.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3215-1 advisory.

  - SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows     context-dependent attackers to cause a denial of service (uninitialized memory access and application     crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by     COLLATE at the end of a SELECT statement. (CVE-2015-3414)

  - The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison     operators, which allows context-dependent attackers to cause a denial of service (invalid free operation)     or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a     CREATE TABLE statement. (CVE-2015-3415)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other     products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-     read or possibly unspecified other impact. (CVE-2017-10989)

  - An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is     affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the     SQLite component. It allows remote attackers to execute arbitrary code or cause a denial of service     (buffer overflow and application crash) via a crafted SQL statement. (CVE-2017-2518)

  - SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant     buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote     attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in     certain WebSQL use cases), aka Magellan. (CVE-2018-20346)

  - In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could     cause a NULL pointer dereference, related to build.c and prepare.c. (CVE-2018-8740)

  - In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application     because of missing validation of a sqlite_stat1 sz field, aka a severe division by zero in the query     planner. (CVE-2019-16168)

  - sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window     functions, and also has certain ORDER BY usage. (CVE-2019-19244)

  - lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated     column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
    (CVE-2019-19317)

  - SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application     crash. (CVE-2019-19603)

  - alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-     referential views in conjunction with ALTER TABLE statements. (CVE-2019-19645)

  - pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain     cases of generated columns. (CVE-2019-19646)

  - exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference     because constant integer values in ORDER BY clauses of window definitions are mishandled. (CVE-2019-19880)

  - flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT     JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect     results). (CVE-2019-19923)

  - SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This     is caused by incorrect sqlite3WindowRewrite() error handling. (CVE-2019-19924)

  - zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP     archive. (CVE-2019-19925)

  - multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by     errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2019-19880. (CVE-2019-19926)

  - ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving     embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for     example) valgrind. (CVE-2019-19959)

  - selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
    (CVE-2019-20218)

  - SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode()     function when handling invalid rtree tables. (CVE-2019-8457)

  - SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. (CVE-2020-13434)

  - SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. (CVE-2020-13435)

  - ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet     feature. (CVE-2020-13630)

  - SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related     to alter.c and build.c. (CVE-2020-13631)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query. (CVE-2020-13632)

  - In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy     heap overflow because of misuse of transitive properties for constant propagation. (CVE-2020-15358)

  - In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and     segmentation fault because of generated column optimizations. (CVE-2020-9327)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Multiple flaws were found in sqlite. An attacker having     the ability to run arbitrary SQL commands could use     this flaw to execute arbitrary code with the permission     of the user running the sqlite     application.(CVE-2018-20346)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4019-1 advisory.

    It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this     issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2518, CVE-2017-2520)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
    (CVE-2018-20505)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu     18.10. (CVE-2018-20346, CVE-2018-20506)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to access sensitive information. (CVE-2019-8457)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and     Ubuntu 18.10. (CVE-2019-9936)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS and Ubuntu 18.10. (CVE-2019-9937)

    It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)

    It was discovered that SQLite incorrectly handled certain databases. An attacker could possibly use this     issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)

    It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue     to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)

    It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this     issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2519)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the sqlite package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Multiple flaws were found in sqlite. An attacker having     the ability to run arbitrary SQL commands could use     this flaw to execute arbitrary code with the permission     of the user running the sqlite     application.(CVE-2018-20346)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Multiple flaws were found in sqlite. An attacker having     the ability to run arbitrary SQL commands could use     this flaw to execute arbitrary code with the permission     of the user running the sqlite     application.(CVE-2018-20346)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201904-21 (SQLite: Remote code execution)

    An integer overflow was discovered in SQLite&rsquo;s FTS3 extension.
  Impact :

    A remote attacker could, by executing arbitrary SQL statements against a       vulnerable host, execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update for sqlite3 fixes the following issues :

Security issues fixed :

CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled (bsc#1131576).

CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687).

CVE-2016-6153: Fixed incorrect permissions when creating temporary files (bsc#987394).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 fixes the following issues :

Security issues fixed :

  - CVE-2018-20346: Fixed a remote code execution     vulnerability in FTS3 (Magellan) (bsc#1119687).

  - CVE-2018-20506: Fixed an integer overflow when FTS3     extension is enabled (bsc#1131576). 

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

 - Multiple unspecified vulnerabilities in WebKit can lead to arbitrary code execution if a user is enticed to visit a malicious web page. (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

 - A maliciously crafted SQL query could lead to arbitrary code execution. (CVE-2018-20346, CVE-2018-20505, CVE-2018-20506)

 - A malicious application could lead to arbitrary code execution with kernel privileges. (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

 - AppleKeyStore
 - Bluetooth
 - Core Media
 - CoreAnimation
 - FaceTime
 - IOKit
 - Kernel
 - libxpc
 - Natural Language Processing
 - QuartzCore
 - SQLite
 - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update for sqlite3 fixes the following issues :

Security issues fixed :

CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687).

CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled (bsc#1131576).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 to version 3.27.2 fixes the following issue :

Security issue fixed :

  - CVE-2018-20346: Fixed a remote code execution     vulnerability in FTS3 (Magellan) (bsc#1119687).

Release notes: https://www.sqlite.org/releaselog/3_27_2.html

This update was imported from the SUSE:SLE-15:Update update project.

This update for sqlite3 fixes the following issue :

Security issue fixed :

CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 to version 3.27.2 fixes the following issue :

Security issue fixed :

CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687).

Release notes: https://www.sqlite.org/releaselog/3_27_2.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iTunes installed on the remote Windows host is prior to 12.9.3. It is, therefore, affected by multiple vulnerabilities as referenced in the HT209450 advisory:

  - Multiple vulnerabilities exist due to input processing     flaws in the WebKit component. An attacker may be able     to leverage one of these vulnerability, by providing     maliciously crafted web content, to execute arbitrary     code on the host. (CVE-2019-6212, CVE-2019-6215,     CVE-2019-6216, CVE-2019-6217, CVE-2019-6226,     CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

  - A universal cross-site scripting vulnerability exists in     the WebKit component. An attacker may be able to leverage     this vulnerability, by providing maliciously crafted web     content, to execute arbitrary script code in the security     context of any site. (CVE-2019-6229)

  - A memory corruption vulnerability exists in the     AppleKeyStore component. An attacker may be able to     leverage this vulnerability to allow a process to     circumvent sandbox restrictions. (CVE-2019-6235)

  - An out-of-bounds read vulnerability exists in the     Core Media component. An attacker may be able to leverage     this vulnerability to allow a malicious application to     elevate its privileges. (CVE-2019-6221)

  - Multiple memory corruption issues exist in the SQLite     component. An attacker may be able to leverage these     vulnerabilities, by executing a malicious SQL query, to     execute arbitrary code on the host. (CVE-2018-20346,     CVE-2018-20505, CVE-2018-20506)


Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

  - AppleKeyStore
  - Bluetooth
  - Core Media
  - CoreAnimation
  - FaceTime
  - IOKit
  - Kernel
  - libxpc
  - Natural Language Processing
  - QuartzCore
  - SQLite
  - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

  - Multiple unspecified vulnerabilities in WebKit     can lead to arbitrary code execution if a user     is enticed to visit a malicious web page.
    (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

  - A maliciously crafted SQL query could lead to     arbitrary code execution.
    (CVE-2018-20346, CVE-2018-20505,     CVE-2018-20506)

  - A malicious application could lead to arbitrary     code execution with kernel privileges.
    (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

Security experts at Tencent&rsquo;s Blade security team have discovered a critical vulnerability in SQLite database software (nicknamed 'Magellan').

The 'Magellan' remote code execution vulnerability has now been fixed by adding extra defenses against strategically corrupt databases to fts3/4.

For Debian 8 'Jessie', this problem has been fixed in version 3.8.7.1-1+deb8u3.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203709	Photon OS 3.0: Sqlite PHSA-2019-3.0-0002	Nessus	PhotonOS Local Security Checks	high
153643	SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2021:3215-1)	Nessus	SuSE Local Security Checks	critical
133300	Photon OS 1.0: Sqlite PHSA-2019-1.0-0209	Nessus	PhotonOS Local Security Checks	high
128922	EulerOS 2.0 SP2 : sqlite (EulerOS-SA-2019-1870)	Nessus	Huawei Local Security Checks	high
126065	Ubuntu 16.04 LTS / 18.04 LTS : SQLite vulnerabilities (USN-4019-1)	Nessus	Ubuntu Local Security Checks	critical
124913	EulerOS Virtualization for ARM 64 3.0.1.0 : sqlite (EulerOS-SA-2019-1410)	Nessus	Huawei Local Security Checks	high
124743	EulerOS Virtualization 2.5.3 : sqlite (EulerOS-SA-2019-1365)	Nessus	Huawei Local Security Checks	high
124226	GLSA-201904-21 : SQLite: Remote code execution	Nessus	Gentoo Local Security Checks	high
124150	SUSE SLES12 Security Update : sqlite3 (SUSE-SU-2019:0973-1)	Nessus	SuSE Local Security Checks	high
124143	openSUSE Security Update : sqlite3 (openSUSE-2019-1222)	Nessus	SuSE Local Security Checks	high
700556	Apple iOS < 12.1.3 Multiple Vulnerabilities (APPLE-SA-2019-1-22-1)	Nessus Network Monitor	Mobile Devices	medium
700521	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
123967	SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2019:0913-1)	Nessus	SuSE Local Security Checks	high
123814	openSUSE Security Update : sqlite3 (openSUSE-2019-1159)	Nessus	SuSE Local Security Checks	high
123639	SUSE SLES11 Security Update : sqlite3 (SUSE-SU-2019:14003-1)	Nessus	SuSE Local Security Checks	high
123626	EulerOS 2.0 SP5 : sqlite (EulerOS-SA-2019-1152)	Nessus	Huawei Local Security Checks	high
123499	SUSE SLED15 / SLES15 Security Update : sqlite3 (SUSE-SU-2019:0788-1)	Nessus	SuSE Local Security Checks	high
123119	EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2019-1106)	Nessus	Huawei Local Security Checks	high
121473	Apple iTunes < 12.9.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
121393	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
121331	Apple iOS < 12.1.3 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
119848	Debian DLA-1613-1 : sqlite3 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-20346

high

Tenable Plugins

high

critical

high

high

critical

high

high

high

high

high

medium

critical

high

high

high

high

high

high

critical

critical

critical

high