IBM Security Bulletin: Public disclosed vulnerability from SQLite CVE-2018-20346

Apr 23, 2019 9:01 am EDT

Categorized: High Severity

Share this post:

IBM Tivoli Composite Application Manager (ITCAM) for Transactions – Transaction Tracking has addressed the following SQLite vulnerability: SQLite could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow when the FTS3 extension is enabled. By using specially-crafted SQL statements, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE(s): CVE-2018-20346

Affected product(s) and affected version(s):

ITCAM for Transaction Tracking:

7.4.0.1,

7.4.0.1 IFix 11,

7.4.0.1 IFix 17,

7.4.0.1 IFix 26,

7.4.0.1 IFix 28,

7.4.0.1 IFix 33,

7.4.0.2

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10878759
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/154623

from IBM Product Security Incident Response Team https://ibm.co/2W167G5