Bug 234112 - SQLite: Remote code execution vulnerability (Magellan)
Summary: SQLite: Remote code execution vulnerability (Magellan)
Status: Open
Alias: None
Product: Services
Classification: Unclassified
Component: Security Team (show other bugs)
Version: unspecified
Hardware: Any Any
: --- Affects Many People
Assignee: Security Team
URL: https://blade.tencent.com/magellan/in...
Keywords: security, tracking
Depends on: 233712 233990 234113 234191
Blocks:
  Show dependency treegraph
 
Reported: 2018-12-18 03:20 UTC by Kubilay Kocak
Modified: 2019-02-15 18:36 UTC (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kubilay Kocak freebsd_committer freebsd_triage 2018-12-18 03:20:30 UTC
Tracking issue to coordinate and link related issues and changes in FreeBSD related to the announced vulnerability:

Quote:

Magellan is a remote code execution vulnerability discovered by Tencent Blade Team that exists in SQLite. As a well-known database, SQLite is widely used in all modern mainstream operating systems and software, so this vulnerability has a wide range of influence. After testing Chromium was also affected by this vulnerability, Google has confirmed and fixed this vulnerability. We will not disclose any details of the vulnerability at this time, and we are pushing other vendors to fix this vulnerability as soon as possible.

Additional References:

- https://access.redhat.com/errata/RHSA-2018:3803
- https://www.debian.org/security/2018/dsa-4352
- https://lwn.net/Articles/774463/
Comment 1 Jochen Neumeister freebsd_committer 2019-02-15 18:36:52 UTC
what is the current status?
Does ports-secteam have to be active here?