CVE-2018-20346: SQL Injection

Multiple flaws were found in sqlite. An attacker who is able to run arbitrary SQL statements could use this flaw to corrupt the internal databases, which can lead to arbitrary code execution as the user running sqlite.

This issue was fixed via sqlite-3.25.3 release at: https://www.sqlite.org/releaselog/3253.html

Also sqlite-3.36 introduced SQLITEDBCONFIGDEFENSIVE option which when added to the config file, could prevent attackers for corrupting the internal database files. This could however break applications which require users to write these database files. https://www.sqlite.org/releaselog/3260.html https://www.sqlite.org/c3ref/cdbconfigdefensive.html#sqlitedbconfigdefensive

— Red Hat

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

— Launchpad

SQLite. Multiple memory corruption issues were addressed with improved input validation.