The Patching Friars' AlmanacA calendar of CVE saints

December 14

MagellanHoly card for magellan, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 FTS3 Magellan VIAM SQL INVENIT
🤖 Image and text generated with AI

⬇ Download holy card: ·

⚔ Commemorated today: The Scourge of TRITON, Enemy of Safety (2017)

Embed on your site

Saint Magellan, Who Charted SQLite's Routes

Patron of SQLite wherever it hides, the FTS3 extension, and devices you never knew spoke SQL.

Life

In December 2018 the Tencent Blade Team disclosed Magellan, a flaw in SQLite's FTS3 full-text search extension: with crafted changes to shadow tables, certain queries triggered an integer and then a buffer overflow, up to code execution. Since SQLite is everywhere, from Chrome to Google Home, merely being able to send SQL was a risk; SQLite's creator played down its reach, but the fix landed in 3.25.3.

Prayer

O Saint Magellan, who finds new routes in a database that is in every pocket, let no one send SQL to those not expecting it. Amen.

How to celebrate

Celebrated by updating SQLite to 3.25.3 and wondering how many of your devices run it, quietly.

SQLite is everywhere, and everywhere can be sailed.

Technical record

Disclosed on
December 14 2018
CVE
CVE-2018-20346

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

Sources: blade.tencent.com · web.archive.org

Commemorated today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.