CVE-2018-20505
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote...
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
7.5
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
CVE-2018-20505- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
CVE-2018-20505- Updated
- 2026-11-02
EUVDEUVD-2018-13059 No score
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
EUVD-2018-13059- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rx75-3g2g-6hp5
7.5
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote...
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
GHSA-rx75-3g2g-6hp5- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVAZL-38170
7.5
CVE-2018-20505 affecting package ceph for versions less than 18.2.1-1
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
AZL-38170- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
7.5
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
CVE-2018-20505- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20505
7.5
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
DEBIAN-CVE-2018-20505- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-20505
7.5
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
- Record
UBUNTU-CVE-2018-20505- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-4019-1 No score
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2518, CVE-2017-2520)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20505)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20346, CVE-2018-20506)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. (CVE-2019-8457)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9936)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9937)
It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)
It was discovered that SQLite incorrectly handled certain databases. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989)
It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)
It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2519)
- Record
USN-4019-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cephAzure Linux:3 |
before 18.2.1-1 | 18.2.1-1 |
sqlite3Debian:12 |
before 3.25.3-1 | 3.25.3-1 |
sqlite3Debian:13 |
before 3.25.3-1 | 3.25.3-1 |
sqlite3Debian:14 |
before 3.25.3-1 | 3.25.3-1 |
sqlite3Ubuntu:18.04:LTS |
before 3.22.0-1ubuntu0.1, plus listed versions 3.19.3-33.20.1-23.21.0-13.22.0-1 |
3.22.0-1ubuntu0.1 |
sqlite3Ubuntu:16.04:LTS From an advisory covering 12 CVEs |
before 3.11.0-1ubuntu1.2, plus listed versions 3.8.11.1-13.9.1-23.9.2-13.10.0-13.10.1-13.10.2-13.11.0-1ubuntu13.11.0-1ubuntu1.1 |
3.11.0-1ubuntu1.2 |
sqlite3Ubuntu:18.04:LTS From an advisory covering 12 CVEs |
before 3.22.0-1ubuntu0.1, plus listed versions 3.19.3-33.20.1-23.21.0-13.22.0-1 |
3.22.0-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20505 is a high vulnerability (CVSS 7.5) in Sqlite, published April 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.89%, the 94th percentile. Fixed in ceph 18.2.1-1.
References
seclists.org/fulldisclosure/2019/Jan/62
seclists.org/fulldisclosure/2019/Jan/64
seclists.org/fulldisclosure/2019/Jan/66
seclists.org/fulldisclosure/2019/Jan/67
seclists.org/fulldisclosure/2019/Jan/68
seclists.org/fulldisclosure/2019/Jan/69
Show 33 moreShow less
securityfocus.com/bid/106698
seclists.org/bugtraq/2019/Jan/28
seclists.org/bugtraq/2019/Jan/29
seclists.org/bugtraq/2019/Jan/31
seclists.org/bugtraq/2019/Jan/32
seclists.org/bugtraq/2019/Jan/33
seclists.org/bugtraq/2019/Jan/39
support.apple.com/kb/HT209443
support.apple.com/kb/HT209446
support.apple.com/kb/HT209447
support.apple.com/kb/HT209448
support.apple.com/kb/HT209450
support.apple.com/kb/HT209451
sqlite.org/src/info/1a84668dcfdebaf12415d
security.netapp.com/advisory/ntap-20190502-0004
usn.ubuntu.com/4019-1
nvd.nist.gov/vuln/detail/CVE-2018-20505
github.com/advisories/GHSA-rx75-3g2g-6hp5
security-tracker.debian.org/tracker/CVE-2018-20505
ubuntu.com/security/CVE-2018-20505
ubuntu.com/security/notices/USN-4019-1
cve.org/CVERecord?id=CVE-2018-20505
ubuntu.com/security/CVE-2016-6153
ubuntu.com/security/CVE-2017-2518
ubuntu.com/security/CVE-2017-2519
ubuntu.com/security/CVE-2017-2520
ubuntu.com/security/CVE-2017-10989
ubuntu.com/security/CVE-2017-13685
ubuntu.com/security/CVE-2018-20346
ubuntu.com/security/CVE-2018-20506
ubuntu.com/security/CVE-2019-8457
ubuntu.com/security/CVE-2019-9936
ubuntu.com/security/CVE-2019-9937