What’s Vulnerable › Vulnerabilities

CVE-2018-20505

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-03 · updated 2026-06-17
• Weakness: CWE-89

Description

SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

Affected products

• Apple iCloud for Windows: before 7.10 — fixed in 7.10
• Apple Iphone Os: before 12.1.3 — fixed in 12.1.3
• Apple iTunes for Windows: before 12.9.3 — fixed in 12.9.3
• macOS: before 10.14.2 — fixed in 10.14.2
• Apple watchOS: before 5.1.3 — fixed in 5.1.3
• SQLite: through 3.25.2

How to fix

Upgrade to a fixed version: Apple iCloud for Windows 7.10; Apple Iphone Os 12.1.3; Apple iTunes for Windows 12.9.3; macOS 10.14.2; Apple watchOS 5.1.3. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2019/Jan/62
• http://seclists.org/fulldisclosure/2019/Jan/64
• http://seclists.org/fulldisclosure/2019/Jan/66
• http://seclists.org/fulldisclosure/2019/Jan/67
• http://seclists.org/fulldisclosure/2019/Jan/68
• http://seclists.org/fulldisclosure/2019/Jan/69
• http://www.securityfocus.com/bid/106698
• https://seclists.org/bugtraq/2019/Jan/28
• https://seclists.org/bugtraq/2019/Jan/29
• https://seclists.org/bugtraq/2019/Jan/31
• https://seclists.org/bugtraq/2019/Jan/32
• https://seclists.org/bugtraq/2019/Jan/33

Get alerted when CVE-2018-20505 or the next vulnerability affects your stack