SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

🗓️ 30 Jun 2024 14:00:00Reported by MicrosoftType

SQLite pre-3.25.3 FTS3 merge overflow enables remote code execution via crafted shadow tables.

Reporter	Title	Published	Views	Family All 143
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in SQLite affects IBM Watson Studio Local	20 Dec 201914:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerability in SQLite (CVE-2018-20346)	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: A vulneraqbility in SQLite affects IBM Cloud Application Performance Managment R esponse Time Monitoring Agent (CVE-2018-20346)	26 Apr 201907:50	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from SQLite CVE-2018-20346	10 May 201914:33	–	ibm
IBM Security Bulletins	Security Bulletin: Guardium StealthBits Integration is affected by an SQLite vulnerability	26 Jun 201919:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in SQLite (CVE-2018-20346)	10 Jan 202021:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software has multiple vulnerabilities	15 Apr 202502:43	–	ibm
Tenable Nessus	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	10 Apr 201900:00	–	nessus
Tenable Nessus	Apple iOS < 12.1.3 Multiple Vulnerabilities (APPLE-SA-2019-1-22-1)	17 Apr 201900:00	–	nessus
Tenable Nessus	Apple iOS < 12.1.3 Multiple Vulnerabilities	23 Jan 201900:00	–	nessus