CVE catalog

CVE-2018-8740

sqlite3: CVE-2018-8740

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Published
Source
[NVD] · [CVE record]
EPSS
7.97% · Oct 25, 2026

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansqlite3sid3.53.4-2fixed
Debiansqlite3forky3.53.4-2fixed
Debiansqlite3trixie3.46.1-7+deb13u2fixed
Debiansqlite3bookworm3.40.1-2+deb12u2fixed
Ubuntusqlite316.043.8.11.1-1vulnerable
Ubuntusqlite316.043.9.1-2vulnerable
Ubuntusqlite316.043.9.2-1vulnerable
Ubuntusqlite316.043.10.0-1vulnerable
Ubuntusqlite316.043.10.1-1vulnerable
Ubuntusqlite316.043.10.2-1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.2vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.3fixed
Ubuntusqlite318.043.19.3-3vulnerable
Ubuntusqlite318.043.20.1-2vulnerable
Ubuntusqlite318.043.21.0-1vulnerable
Ubuntusqlite318.043.22.0-1vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.1vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.2fixed
Ubuntusqlite316.043.8.11.1-1vulnerable
Ubuntusqlite316.043.9.1-2vulnerable
Ubuntusqlite316.043.9.2-1vulnerable
Ubuntusqlite316.043.10.0-1vulnerable
Ubuntusqlite316.043.10.1-1vulnerable
Ubuntusqlite316.043.10.2-1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.2vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.3vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.4vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.5fixed
Ubuntusqlite318.043.19.3-3vulnerable
Ubuntusqlite318.043.20.1-2vulnerable
Ubuntusqlite318.043.21.0-1vulnerable
Ubuntusqlite318.043.22.0-1vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.1vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.2vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.3vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.4fixed
Ubuntusqlite320.043.29.0-2vulnerable
Ubuntusqlite320.043.30.1-1vulnerable
Ubuntusqlite320.043.30.1-1ubuntu1vulnerable
Ubuntusqlite320.043.31.1-1ubuntu1vulnerable
Ubuntusqlite320.043.31.1-3vulnerable
Ubuntusqlite320.043.31.1-4vulnerable
Ubuntusqlite320.043.31.1-4ubuntu0.1fixed
Ubuntusqlite314.043.7.17-1ubuntu1vulnerable
Ubuntusqlite314.043.8.0.2-1ubuntu1vulnerable
Ubuntusqlite314.043.8.1-1ubuntu1vulnerable
Ubuntusqlite314.043.8.1-1ubuntu3vulnerable
Ubuntusqlite314.043.8.2-1ubuntu1vulnerable
Ubuntusqlite314.043.8.2-1ubuntu2vulnerable
Ubuntusqlite314.043.8.2-1ubuntu2.1vulnerable
Ubuntusqlite314.043.8.2-1ubuntu2.2fixed
Ubuntusqlite316.043.8.11.1-1vulnerable
Ubuntusqlite316.043.9.1-2vulnerable
Ubuntusqlite316.043.9.2-1vulnerable
Ubuntusqlite316.043.10.0-1vulnerable
Ubuntusqlite316.043.10.1-1vulnerable
Ubuntusqlite316.043.10.2-1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1vulnerable
Ubuntusqlite316.043.11.0-1ubuntu1.1fixed
Ubuntusqlite318.043.19.3-3vulnerable
Ubuntusqlite318.043.20.1-2vulnerable
Ubuntusqlite318.043.21.0-1vulnerable
Ubuntusqlite318.043.22.0-1vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.1vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.2vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.3vulnerable
Ubuntusqlite318.043.22.0-1ubuntu0.4fixed
Opensusesqlite3tumbleweed3.36.0-1.2fixed
Alpinesqlite3.43.13.0-r2fixed
Alpinesqlite3.53.15.2-r2fixed
Alpinesqlite3.63.20.1-r2fixed
Alpinesqlite3.73.21.0-r1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansqlite3sourcesid3.22.0-2not yet assignedNot reported[893195]
Debiansqlite3sourceforky3.22.0-2not yet assignedNot reported[893195]
Debiansqlite3sourcetrixie3.22.0-2not yet assignedNot reported[893195]
Debiansqlite3sourcebookworm3.22.0-2not yet assignedNot reported[893195]
Ubuntusqlite3deb16.043.11.0-1ubuntu1.3Not reportedUSN-4205-1Not reported
Ubuntusqlite3deb18.043.22.0-1ubuntu0.2Not reportedUSN-4205-1Not reported
Ubuntusqlite3deb16.043.11.0-1ubuntu1.5Not reportedUSN-4394-1Not reported
Ubuntusqlite3deb18.043.22.0-1ubuntu0.4Not reportedUSN-4394-1Not reported
Ubuntusqlite3deb20.043.31.1-4ubuntu0.1Not reportedUSN-4394-1Not reported
Ubuntusqlite3deb14.043.8.2-1ubuntu2.2Not reportedUBUNTU-CVE-2018-8740Not reported
Ubuntusqlite3deb16.043.11.0-1ubuntu1.1Not reportedUBUNTU-CVE-2018-8740Not reported
Ubuntusqlite3deb18.043.22.0-1ubuntu0.4Not reportedUBUNTU-CVE-2018-8740Not reported
Opensusesqlite3rpmtumbleweed3.36.0-1.2Not reportedOPENSUSE-SU-2024:11400-1Not reported
Alpinesqliteapk3.43.13.0-r2Not reportedALPINE-CVE-2018-8740Not reported
Alpinesqliteapk3.53.15.2-r2Not reportedALPINE-CVE-2018-8740Not reported
Alpinesqliteapk3.63.20.1-r2Not reportedALPINE-CVE-2018-8740Not reported
Alpinesqliteapk3.73.21.0-r1Not reportedALPINE-CVE-2018-8740Not reported

[Debian bug #893195]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [lemon]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

  • [libsqlite3-0]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

  • [libsqlite3-dev]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

  • [libsqlite3-tcl]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

  • [sqlite3]Unknown
    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

  • [sqlite3-doc]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · all · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · all · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

  • [sqlite3-tools]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · bookworm; dsa · sqlite3 · debian · 12

[Debian 13 (Trixie)]

  • [lemon]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [libsqlite3-0]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [libsqlite3-dev]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [libsqlite3-ext-csv]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [libsqlite3-ext-icu]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [libsqlite3-tcl]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [sqlite3]Unknown
    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [sqlite3-doc]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · all · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · all · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

  • [sqlite3-tools]Unknown

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.22.0-2

      dsa · sqlite3 · debian · 13

[openSUSE Tumbleweed]

  • [lemon]Unknown

    Source package: [sqlite3]

    Details (1)

    • 3.53.2-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.36.0-1.2

      Version impact unknown

      dsa · sqlite3 · opensuse · tumbleweed

  • [libsqlite3-0]Unknown

    Source package: [sqlite3]

    Details (1)

    • 3.53.2-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.36.0-1.2

      Version impact unknown

      dsa · sqlite3 · opensuse · tumbleweed

  • [libsqlite3-0-32bit]Unknown

    Source package: [sqlite3]

    Details (1)

    • 3.53.2-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.36.0-1.2

      Version impact unknown

      dsa · sqlite3 · opensuse · tumbleweed

  • [libsqlite3-0-x86-64-v3]Unknown

    Source package: [sqlite3]

    Details (1)

    • 3.53.2-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.36.0-1.2

      Version impact unknown

      dsa · sqlite3 · opensuse · tumbleweed

Next results

Observed:

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]