var-201904-0985
Vulnerability from variot
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). SQLite Is SQL An injection vulnerability exists.Service operation interruption (DoS) There is a possibility of being put into a state. SQLite is an open source embedded relational database management system based on C language developed by American D.Richard Hipp software developer. The system has the characteristics of independence, isolation and cross-platform. A security vulnerability exists in SQLite version 3.25.2. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements.
Alternatively, on your watch, select "My Watch > General > About". ========================================================================= Ubuntu Security Notice USN-4019-1 June 19, 2019
sqlite3 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in SQLite.
Software Description: - sqlite3: C library that implements an SQL database engine
Details:
It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2518, CVE-2017-2520)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20505)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20346, CVE-2018-20506)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. (CVE-2019-8457)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9936)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9937)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)
It was discovered that SQLite incorrectly handled certain databases. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)
It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2519)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 19.04: libsqlite3-0 3.27.2-2ubuntu0.1 sqlite3 3.27.2-2ubuntu0.1
Ubuntu 18.10: libsqlite3-0 3.24.0-1ubuntu0.1 sqlite3 3.24.0-1ubuntu0.1
Ubuntu 18.04 LTS: libsqlite3-0 3.22.0-1ubuntu0.1 sqlite3 3.22.0-1ubuntu0.1
Ubuntu 16.04 LTS: libsqlite3-0 3.11.0-1ubuntu1.2 sqlite3 3.11.0-1ubuntu1.2
In general, a standard system update will make all the necessary changes.
References: https://usn.ubuntu.com/4019-1 CVE-2016-6153, CVE-2017-10989, CVE-2017-13685, CVE-2017-2518, CVE-2017-2519, CVE-2017-2520, CVE-2018-20346, CVE-2018-20505, CVE-2018-20506, CVE-2019-8457, CVE-2019-9936, CVE-2019-9937
Package Information: https://launchpad.net/ubuntu/+source/sqlite3/3.27.2-2ubuntu0.1 https://launchpad.net/ubuntu/+source/sqlite3/3.24.0-1ubuntu0.1 https://launchpad.net/ubuntu/+source/sqlite3/3.22.0-1ubuntu0.1 https://launchpad.net/ubuntu/+source/sqlite3/3.11.0-1ubuntu1.2 . CVE-2018-4467: Martim Carbone, David Vernet, Sam Scalise, and Fred Jacobs of the Virtual Machine Monitor Group of VMware, Inc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2019-1-22-1 iOS 12.1.3
iOS 12.1.3 is now available and addresses the following:
AppleKeyStore Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: A memory corruption issue was addressed with improved validation. CVE-2019-6235: Brandon Azad
Bluetooth Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to execute arbitrary code Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-6200: an anonymous researcher
Core Media Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2019-6202: Fluoroacetate working with Trend Micro's Zero Day Initiative CVE-2019-6221: Fluoroacetate working with Trend Micro's Zero Day Initiative
CoreAnimation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2019-6231: Zhuo Liang of Qihoo 360 Nirvan Team
CoreAnimation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to break out of its sandbox Description: A memory initialization issue was addressed with improved memory handling. CVE-2019-6230: Proteas, Shrek_wzw and Zhuo Liang of Qihoo 360 Nirvan Team
FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A remote attacker may be able to initiate a FaceTime call causing arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-6224: Natalie Silvanovich of Google Project Zero
IOKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to break out of its sandbox Description: A type confusion issue was addressed with improved memory handling. CVE-2019-6214: Ian Beer of Google Project Zero
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A memory corruption issue was addressed with improved validation. CVE-2019-6225: Brandon Azad of Google Project Zero, Qixun Zhao of Qihoo 360 Vulcan Team
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-6210: Ned Williamson of Google
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may cause unexpected changes in memory shared between processes Description: A memory corruption issue was addressed with improved lock state checking. CVE-2019-6205: Ian Beer of Google Project Zero
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved bounds checking. CVE-2019-6213: Ian Beer of Google Project Zero
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. CVE-2019-6209: Brandon Azad of Google Project Zero
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may cause unexpected changes in memory shared between processes Description: A memory initialization issue was addressed with improved memory handling. CVE-2019-6208: Jann Horn of Google Project Zero
Keyboard Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Password autofill may fill in passwords after they were manually cleared Description: An issue existed with autofill resuming after it was canceled. The issue was addressed with improved state management. CVE-2019-6206: Sergey Pershenkov
libxpc Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-6218: Ian Beer of Google Project Zero
Natural Language Processing Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted message may lead to a denial of service Description: A denial of service issue was addressed with improved validation. CVE-2019-6219: Authier Thomas
Safari Reader Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. CVE-2019-6228: Ryan Pickren (ryanpickren.com)
SQLite Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A maliciously crafted SQL query may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2018-20346: Tencent Blade Team CVE-2018-20505: Tencent Blade Team CVE-2018-20506: Tencent Blade Team
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-6227: Qixun Zhao of Qihoo 360 Vulcan Team CVE-2019-6233: G. Geshev from MWR Labs working with Trend Micro's Zero Day Initiative CVE-2019-6234: G. Geshev from MWR Labs working with Trend Micro's Zero Day Initiative
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved validation. CVE-2019-6229: Ryan Pickren (ryanpickren.com)
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2019-6215: Lokihardt of Google Project Zero
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2019-6212: an anonymous researcher, Wen Xu of SSLab at Georgia Tech CVE-2019-6216: Fluoroacetate working with Trend Micro's Zero Day Initiative CVE-2019-6217: Fluoroacetate working with Trend Micro's Zero Day Initiative, Proteas, Shrek_wzw, and Zhuo Liang of Qihoo 360 Nirvan Team CVE-2019-6226: Apple
WebRTC Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved state management. CVE-2019-6211: Georgi Geshev (@munmap), Fabi Beterke (@pwnfl4k3s), and Rob Miller (@trotmaster99) of MWR Labs (@mwrlabs) working with Trend Micro's Zero Day Initiative
Additional recognition
mDNSResponder We would like to acknowledge Fatemah Alharbi of University of California, Riverside (UCR) and Taibah University (TU), Feng Qian of University of Minnesota - Twin City, Jie Chang of LinkSure Network, Nael Abu-Ghazaleh of University of California, Riverside (UCR), Yuchen Zhou of Northeastern University, and Zhiyun Qian of University of California, Riverside (UCR) for their assistance.
Safari Reader We would like to acknowledge Ryan Pickren (ryanpickren.com) for their assistance.
WebKit We would like to acknowledge James Lee (@Windowsrcer) of Kryptos Logic for their assistance.
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. The version after applying this update will be "iOS 12.1.3".
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlxHSSwpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3GA0RAA l3Yft6CRTyGtLyqIanBFP4sMtaxlIP44Y0+gPIf59DhZ7bzuy3s+cjnUJAxrqBC+ NAqrNur5x8OVBIS7T65njvccD7e7uGWBZfeEbMdplT5aK3AvRuW7MyXEo3nZu3dx gMRsubjQmwOnMB3Taxj0a6y2jvLU9DA7IfVyKb7ReCz3wv5KPb4BxLvbHwaMrbsJ SBETrGYMn4awTSmUs/IQTDECOzRLyicQnY44afDL/K9n/oB59VQm5ZUPDj9ofeQN UQsD7XVH19eI99N+uNQ+07GCqQ6++qe+kGVi2RR7HERt3wd4mnV895f6UvhlUjlU K1tY68ZuDNPZ54GJfniFI0OCYfcd5rYsPTnOt11heFnWfG+nnm2r+3BEh60RW5lW ONeyQ3ScubgMV2Teo3G0tWf9BGvKAI+qXbFuzkAMAucB+f7Oj06WDGhYPEAQZ8KR xLSb6nyfihQA6Bz4KbfppKC7I2GuyF6rl5iz+VBPHId7yaF0jxjEiJEF7RbLhbeg k7x8vJrKLR7hAs4AWCq69ZQ6VvmKLdgSNNCcbJIQNPCYtGabOP7xl4piDw4b46wq /LR6UNrYdf/U3hljPfKIBn+0e1EITcKHfUu85MyHftanF1JFYNp03eFJT5ouyMRt LD5C8YOX6VcEwCQqUpKmJD9wWwUehRhEiEffGkR+xSY=Jb8S -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201904-0985",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sqlite",
"scope": "lte",
"trust": 1.0,
"vendor": "sqlite",
"version": "3.25.2"
},
{
"model": "watchos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "5.1.3"
},
{
"model": "icloud",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "7.10"
},
{
"model": "itunes",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.9.3"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.1.3"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.14.2"
},
{
"model": "sqlite",
"scope": "eq",
"trust": 0.8,
"vendor": "sqlite",
"version": "3.25.2"
},
{
"model": "mac os x",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "icloud",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "ios",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "itunes",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "watchos",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.25.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.14.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.1.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.1.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "7.10",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.9.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tencent Blade Team,Ubuntu",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
}
],
"trust": 0.6
},
"cve": "CVE-2018-20505",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-20505",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-131318",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-20505",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-20505",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201901-826",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-131318",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2018-20505",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131318"
},
{
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
},
{
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). SQLite Is SQL An injection vulnerability exists.Service operation interruption (DoS) There is a possibility of being put into a state. SQLite is an open source embedded relational database management system based on C language developed by American D.Richard Hipp software developer. The system has the characteristics of independence, isolation and cross-platform. A security vulnerability exists in SQLite version 3.25.2. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. \n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\". =========================================================================\nUbuntu Security Notice USN-4019-1\nJune 19, 2019\n\nsqlite3 vulnerabilities\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 19.04\n- Ubuntu 18.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in SQLite. \n\nSoftware Description:\n- sqlite3: C library that implements an SQL database engine\n\nDetails:\n\nIt was discovered that SQLite incorrectly handled certain SQL files. \nAn attacker could possibly use this issue to execute arbitrary code\nor cause a denial of service. This issue only affected Ubuntu 16.04\nLTS. (CVE-2017-2518, CVE-2017-2520)\n\nIt was discovered that SQLite incorrectly handled certain queries. \nAn attacker could possibly use this issue to execute arbitrary code. \nThis issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20505)\n\nIt was discovered that SQLite incorrectly handled certain queries. \nAn attacker could possibly use this issue to execute arbitrary code. \nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and\nUbuntu 18.10. (CVE-2018-20346, CVE-2018-20506)\n\nIt was discovered that SQLite incorrectly handled certain inputs. \nAn attacker could possibly use this issue to access sensitive information. \n(CVE-2019-8457)\n\nIt was discovered that SQLite incorrectly handled certain queries. \nAn attacker could possibly use this issue to access sensitive information. \nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. \n(CVE-2019-9936)\n\nIt was discovered that SQLite incorrectly handled certain inputs. \nAn attacker could possibly use this issue to cause a crash or execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS\nand Ubuntu 18.10. (CVE-2019-9937)\n\nIt was discovered that SQLite incorrectly handled certain inputs. \nAn attacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)\n\nIt was discovered that SQLite incorrectly handled certain databases. \nAn attacker could possibly use this issue to access sensitive information. \nThis issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)\n\nIt was discovered that SQLite incorrectly handled certain files. \nAn attacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)\n\nIt was discovered that SQLite incorrectly handled certain queries. \nAn attacker could possibly use this issue to execute arbitrary code or\ncause a denial of service. This issue only affected Ubuntu 16.04 LTS. \n(CVE-2017-2519)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 19.04:\n libsqlite3-0 3.27.2-2ubuntu0.1\n sqlite3 3.27.2-2ubuntu0.1\n\nUbuntu 18.10:\n libsqlite3-0 3.24.0-1ubuntu0.1\n sqlite3 3.24.0-1ubuntu0.1\n\nUbuntu 18.04 LTS:\n libsqlite3-0 3.22.0-1ubuntu0.1\n sqlite3 3.22.0-1ubuntu0.1\n\nUbuntu 16.04 LTS:\n libsqlite3-0 3.11.0-1ubuntu1.2\n sqlite3 3.11.0-1ubuntu1.2\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n https://usn.ubuntu.com/4019-1\n CVE-2016-6153, CVE-2017-10989, CVE-2017-13685, CVE-2017-2518,\n CVE-2017-2519, CVE-2017-2520, CVE-2018-20346, CVE-2018-20505,\n CVE-2018-20506, CVE-2019-8457, CVE-2019-9936, CVE-2019-9937\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/sqlite3/3.27.2-2ubuntu0.1\n https://launchpad.net/ubuntu/+source/sqlite3/3.24.0-1ubuntu0.1\n https://launchpad.net/ubuntu/+source/sqlite3/3.22.0-1ubuntu0.1\n https://launchpad.net/ubuntu/+source/sqlite3/3.11.0-1ubuntu1.2\n. \nCVE-2018-4467: Martim Carbone, David Vernet, Sam Scalise, and Fred\nJacobs of the Virtual Machine Monitor Group of VMware, Inc. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2019-1-22-1 iOS 12.1.3\n\niOS 12.1.3 is now available and addresses the following:\n\nAppleKeyStore\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2019-6235: Brandon Azad\n\nBluetooth\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An attacker in a privileged network position may be able to\nexecute arbitrary code\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-6200: an anonymous researcher\n\nCore Media\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to elevate privileges\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2019-6202: Fluoroacetate working with Trend Micro\u0027s Zero Day\nInitiative\nCVE-2019-6221: Fluoroacetate working with Trend Micro\u0027s Zero Day\nInitiative\n\nCoreAnimation\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to read restricted memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2019-6231: Zhuo Liang of Qihoo 360 Nirvan Team\n\nCoreAnimation\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to break out of its\nsandbox\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2019-6230: Proteas, Shrek_wzw and Zhuo Liang of Qihoo 360 Nirvan\nTeam\n\nFaceTime\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A remote attacker may be able to initiate a FaceTime call\ncausing arbitrary code execution\nDescription: A buffer overflow issue was addressed with improved\nmemory handling. \nCVE-2019-6224: Natalie Silvanovich of Google Project Zero\n\nIOKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to break out of its\nsandbox\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2019-6214: Ian Beer of Google Project Zero\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to elevate privileges\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2019-6225: Brandon Azad of Google Project Zero, Qixun Zhao of\nQihoo 360 Vulcan Team\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2019-6210: Ned Williamson of Google\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may cause unexpected changes in\nmemory shared between processes\nDescription: A memory corruption issue was addressed with improved\nlock state checking. \nCVE-2019-6205: Ian Beer of Google Project Zero\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2019-6213: Ian Beer of Google Project Zero\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to determine kernel\nmemory layout\nDescription: An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed with improved input\nvalidation. \nCVE-2019-6209: Brandon Azad of Google Project Zero\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may cause unexpected changes in\nmemory shared between processes\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2019-6208: Jann Horn of Google Project Zero\n\nKeyboard\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Password autofill may fill in passwords after they were\nmanually cleared\nDescription: An issue existed with autofill resuming after it was\ncanceled. The issue was addressed with improved state management. \nCVE-2019-6206: Sergey Pershenkov\n\nlibxpc\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2019-6218: Ian Beer of Google Project Zero\n\nNatural Language Processing\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted message may lead to a denial\nof service\nDescription: A denial of service issue was addressed with improved\nvalidation. \nCVE-2019-6219: Authier Thomas\n\nSafari Reader\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to a\ncross site scripting attack\nDescription: A cross-site scripting issue existed in Safari. This\nissue was addressed with improved URL validation. \nCVE-2019-6228: Ryan Pickren (ryanpickren.com)\n\nSQLite\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A maliciously crafted SQL query may lead to arbitrary code\nexecution\nDescription: Multiple memory corruption issues were addressed with\nimproved input validation. \nCVE-2018-20346: Tencent Blade Team\nCVE-2018-20505: Tencent Blade Team\nCVE-2018-20506: Tencent Blade Team\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-6227: Qixun Zhao of Qihoo 360 Vulcan Team\nCVE-2019-6233: G. Geshev from MWR Labs working with Trend Micro\u0027s\nZero Day Initiative\nCVE-2019-6234: G. Geshev from MWR Labs working with Trend Micro\u0027s\nZero Day Initiative\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\nuniversal cross site scripting\nDescription: A logic issue was addressed with improved validation. \nCVE-2019-6229: Ryan Pickren (ryanpickren.com)\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2019-6215: Lokihardt of Google Project Zero\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed with\nimproved memory handling. \nCVE-2019-6212: an anonymous researcher, Wen Xu of SSLab at Georgia\nTech\nCVE-2019-6216: Fluoroacetate working with Trend Micro\u0027s Zero Day\nInitiative\nCVE-2019-6217: Fluoroacetate working with Trend Micro\u0027s Zero Day\nInitiative, Proteas, Shrek_wzw, and Zhuo Liang of Qihoo 360 Nirvan\nTeam\nCVE-2019-6226: Apple\n\nWebRTC\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed with improved\nstate management. \nCVE-2019-6211: Georgi Geshev (@munmap), Fabi Beterke (@pwnfl4k3s),\nand Rob Miller (@trotmaster99) of MWR Labs (@mwrlabs) working with\nTrend Micro\u0027s Zero Day Initiative\n\nAdditional recognition\n\nmDNSResponder\nWe would like to acknowledge Fatemah Alharbi of University of\nCalifornia, Riverside (UCR) and Taibah University (TU), Feng Qian of\nUniversity of Minnesota - Twin City, Jie Chang of LinkSure Network,\nNael Abu-Ghazaleh of University of California, Riverside (UCR),\nYuchen Zhou of Northeastern University, and Zhiyun Qian of University\nof California, Riverside (UCR) for their assistance. \n\nSafari Reader\nWe would like to acknowledge Ryan Pickren (ryanpickren.com) for their\nassistance. \n\nWebKit\nWe would like to acknowledge James Lee (@Windowsrcer) of Kryptos\nLogic for their assistance. \n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"iOS 12.1.3\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlxHSSwpHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3GA0RAA\nl3Yft6CRTyGtLyqIanBFP4sMtaxlIP44Y0+gPIf59DhZ7bzuy3s+cjnUJAxrqBC+\nNAqrNur5x8OVBIS7T65njvccD7e7uGWBZfeEbMdplT5aK3AvRuW7MyXEo3nZu3dx\ngMRsubjQmwOnMB3Taxj0a6y2jvLU9DA7IfVyKb7ReCz3wv5KPb4BxLvbHwaMrbsJ\nSBETrGYMn4awTSmUs/IQTDECOzRLyicQnY44afDL/K9n/oB59VQm5ZUPDj9ofeQN\nUQsD7XVH19eI99N+uNQ+07GCqQ6++qe+kGVi2RR7HERt3wd4mnV895f6UvhlUjlU\nK1tY68ZuDNPZ54GJfniFI0OCYfcd5rYsPTnOt11heFnWfG+nnm2r+3BEh60RW5lW\nONeyQ3ScubgMV2Teo3G0tWf9BGvKAI+qXbFuzkAMAucB+f7Oj06WDGhYPEAQZ8KR\nxLSb6nyfihQA6Bz4KbfppKC7I2GuyF6rl5iz+VBPHId7yaF0jxjEiJEF7RbLhbeg\nk7x8vJrKLR7hAs4AWCq69ZQ6VvmKLdgSNNCcbJIQNPCYtGabOP7xl4piDw4b46wq\n/LR6UNrYdf/U3hljPfKIBn+0e1EITcKHfUu85MyHftanF1JFYNp03eFJT5ouyMRt\nLD5C8YOX6VcEwCQqUpKmJD9wWwUehRhEiEffGkR+xSY=Jb8S\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-20505"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "VULHUB",
"id": "VHN-131318"
},
{
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"db": "PACKETSTORM",
"id": "151281"
},
{
"db": "PACKETSTORM",
"id": "151283"
},
{
"db": "PACKETSTORM",
"id": "151285"
},
{
"db": "PACKETSTORM",
"id": "153351"
},
{
"db": "PACKETSTORM",
"id": "151284"
},
{
"db": "PACKETSTORM",
"id": "151280"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-20505",
"trust": 3.2
},
{
"db": "BID",
"id": "106698",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU97670311",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201901-826",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "153351",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.3573",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.2196",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.3573.2",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-131318",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-20505",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "151281",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "151283",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "151285",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "151284",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "151280",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131318"
},
{
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "PACKETSTORM",
"id": "151281"
},
{
"db": "PACKETSTORM",
"id": "151283"
},
{
"db": "PACKETSTORM",
"id": "151285"
},
{
"db": "PACKETSTORM",
"id": "153351"
},
{
"db": "PACKETSTORM",
"id": "151284"
},
{
"db": "PACKETSTORM",
"id": "151280"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
},
{
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"id": "VAR-201904-0985",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-131318"
}
],
"trust": 0.01
},
"last_update_date": "2024-07-23T21:26:06.321000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT209448",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht209448"
},
{
"title": "HT209450",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht209450"
},
{
"title": "HT209451",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht209451"
},
{
"title": "HT209443",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht209443"
},
{
"title": "HT209446",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht209446"
},
{
"title": "HT209447",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht209447"
},
{
"title": "HT209451",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht209451"
},
{
"title": "HT209443",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht209443"
},
{
"title": "HT209446",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht209446"
},
{
"title": "HT209447",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht209447"
},
{
"title": "HT209448",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht209448"
},
{
"title": "HT209450",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht209450"
},
{
"title": "Assertion fault due to malformed PRIMARY KEY",
"trust": 0.8,
"url": "https://sqlite.org/src/info/1a84668dcfdebaf12415d"
},
{
"title": "Multiple Apple product SQLite Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=88891"
},
{
"title": "Apple: iTunes 12.9.3 for Windows",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=5e9a1ae4d3b0c180c223e95e54b6a3f0"
},
{
"title": "Apple: iCloud for Windows 7.10",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=ffe17e2a5852c38e881668445157fa2b"
},
{
"title": "Ubuntu Security Notice: sqlite3 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4019-1"
},
{
"title": "Apple: watchOS 5.1.3",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=9a5bc272f06f98395e3a6dbf477daa32"
},
{
"title": "Apple: tvOS 12.1.2",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=09c43c1eeefc4aeae98bd2849d4c85ac"
},
{
"title": "Apple: macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=4b0e119eb423e9c1589f568bf226e6e3"
},
{
"title": "Apple: iOS 12.1.3",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=39f829637e6dd508667aed6a9e0156f7"
},
{
"title": "log-requests-to-sqlite",
"trust": 0.1,
"url": "https://github.com/righettod/log-requests-to-sqlite "
},
{
"title": "BlackHat2019",
"trust": 0.1,
"url": "https://github.com/saiyuki1919/blackhat2019 "
},
{
"title": "TrivyWeb",
"trust": 0.1,
"url": "https://github.com/korayagaya/trivyweb "
},
{
"title": "github_aquasecurity_trivy",
"trust": 0.1,
"url": "https://github.com/back8/github_aquasecurity_trivy "
},
{
"title": "Vulnerability-Scanner-for-Containers",
"trust": 0.1,
"url": "https://github.com/t31m0/vulnerability-scanner-for-containers "
},
{
"title": "security",
"trust": 0.1,
"url": "https://github.com/umahari/security "
},
{
"title": "trivy",
"trust": 0.1,
"url": "https://github.com/siddharthraopotukuchi/trivy "
},
{
"title": "trivy",
"trust": 0.1,
"url": "https://github.com/simiyo/trivy "
},
{
"title": "trivy",
"trust": 0.1,
"url": "https://github.com/aquasecurity/trivy "
},
{
"title": "trivy",
"trust": 0.1,
"url": "https://github.com/knqyf263/trivy "
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/google-chrome-affected-by-magellan-2-0-flaws/151446/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131318"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://usn.ubuntu.com/4019-1/"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/106698"
},
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-20505"
},
{
"trust": 1.8,
"url": "https://security.netapp.com/advisory/ntap-20190502-0004/"
},
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2019/jan/62"
},
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2019/jan/64"
},
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2019/jan/66"
},
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2019/jan/67"
},
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2019/jan/68"
},
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2019/jan/69"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jan/28"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jan/29"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jan/31"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jan/32"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jan/33"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jan/39"
},
{
"trust": 1.8,
"url": "https://sqlite.org/src/info/1a84668dcfdebaf12415d"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht209443"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht209446"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht209447"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht209448"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht209450"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht209451"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-20505"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu97670311/index.html"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-20506"
},
{
"trust": 0.6,
"url": "https://usn.ubuntu.com/4019-2/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2196/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/153351/ubuntu-security-notice-usn-4019-1.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3573.2/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3573/"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-20346"
},
{
"trust": 0.5,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.5,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6226"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6216"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6227"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6217"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6210"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6213"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6214"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6230"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6224"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6231"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6209"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6212"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6215"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6229"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6225"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6205"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6208"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6235"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6218"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6202"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6219"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6233"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6234"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6211"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6200"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6221"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=60420"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/righettod/log-requests-to-sqlite"
},
{
"trust": 0.1,
"url": "https://support.apple.com/ht204283"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht204641"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-2519"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9936"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/sqlite3/3.27.2-2ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-6153"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13685"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9937"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10989"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8457"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/sqlite3/3.22.0-1ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/4019-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/sqlite3/3.11.0-1ubuntu1.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/sqlite3/3.24.0-1ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://support.apple.com/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6220"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4467"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4452"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6228"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6206"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131318"
},
{
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "PACKETSTORM",
"id": "151281"
},
{
"db": "PACKETSTORM",
"id": "151283"
},
{
"db": "PACKETSTORM",
"id": "151285"
},
{
"db": "PACKETSTORM",
"id": "153351"
},
{
"db": "PACKETSTORM",
"id": "151284"
},
{
"db": "PACKETSTORM",
"id": "151280"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
},
{
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-131318"
},
{
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"db": "PACKETSTORM",
"id": "151281"
},
{
"db": "PACKETSTORM",
"id": "151283"
},
{
"db": "PACKETSTORM",
"id": "151285"
},
{
"db": "PACKETSTORM",
"id": "153351"
},
{
"db": "PACKETSTORM",
"id": "151284"
},
{
"db": "PACKETSTORM",
"id": "151280"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
},
{
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-04-03T00:00:00",
"db": "VULHUB",
"id": "VHN-131318"
},
{
"date": "2019-04-03T00:00:00",
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"date": "2019-05-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"date": "2019-01-23T21:27:12",
"db": "PACKETSTORM",
"id": "151281"
},
{
"date": "2019-01-23T21:28:00",
"db": "PACKETSTORM",
"id": "151283"
},
{
"date": "2019-01-23T21:28:42",
"db": "PACKETSTORM",
"id": "151285"
},
{
"date": "2019-06-19T23:51:58",
"db": "PACKETSTORM",
"id": "153351"
},
{
"date": "2019-01-23T21:28:27",
"db": "PACKETSTORM",
"id": "151284"
},
{
"date": "2019-01-23T21:27:00",
"db": "PACKETSTORM",
"id": "151280"
},
{
"date": "2019-01-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-826"
},
{
"date": "2019-04-03T18:29:00.673000",
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-06-19T00:00:00",
"db": "VULHUB",
"id": "VHN-131318"
},
{
"date": "2019-06-19T00:00:00",
"db": "VULMON",
"id": "CVE-2018-20505"
},
{
"date": "2019-05-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-015216"
},
{
"date": "2020-10-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-826"
},
{
"date": "2019-06-19T19:15:10.937000",
"db": "NVD",
"id": "CVE-2018-20505"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQLite In SQL Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015216"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-826"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.