CVE-2018-20505

moderate-risk

Published 2019-04-03

SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

Do I need to act?

7.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (6)

Sqlite

Iphone Os

Mac Os X

Watchos

Icloud

Itunes

Affected Vendors

Apple Sqlite

References (44)

Mailing List http://seclists.org/fulldisclosure/2019/Jan/62

Mailing List http://seclists.org/fulldisclosure/2019/Jan/64

Mailing List http://seclists.org/fulldisclosure/2019/Jan/66

Mailing List http://seclists.org/fulldisclosure/2019/Jan/67

Mailing List http://seclists.org/fulldisclosure/2019/Jan/68

Mailing List http://seclists.org/fulldisclosure/2019/Jan/69

Third Party Advisory http://www.securityfocus.com/bid/106698

Mailing List https://seclists.org/bugtraq/2019/Jan/28

Mailing List https://seclists.org/bugtraq/2019/Jan/29

Mailing List https://seclists.org/bugtraq/2019/Jan/31

Mailing List https://seclists.org/bugtraq/2019/Jan/32

Mailing List https://seclists.org/bugtraq/2019/Jan/33

Mailing List https://seclists.org/bugtraq/2019/Jan/39

Third Party Advisory https://security.netapp.com/advisory/ntap-20190502-0004/

Exploit https://sqlite.org/src/info/1a84668dcfdebaf12415d

Vendor Advisory https://support.apple.com/kb/HT209443

Vendor Advisory https://support.apple.com/kb/HT209446

Vendor Advisory https://support.apple.com/kb/HT209447

Vendor Advisory https://support.apple.com/kb/HT209448

Vendor Advisory https://support.apple.com/kb/HT209450

and 24 more references

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 10/34 · Low

Exposure 13/34 · Low