[German]In the Google Chrome (Chromium) browser (and other software that uses SQLite), there were some vulnerabilities, called Magellan 2.0, in SQLite, which was closed with the update to Chrome 79.0.3945.79 or with a SQLite code commit of December 13, 2019.
Advertising
Magellan 2.0 is a total of five vulnerabilities that exist in SQLite (there were already Magellan 1.0, vulnerabilities found some time ago). Building on the findings for Magellan 1.0, security researchers from the Tencent Blade Team have identified the new vulnerabilities that allow remote code execution in the chromium rendering process. The security researchers have published this article on the topic.
Vulnerability in SQLite
SQLite is widely used as a database in all modern mainstream operating systems and in various software. A weakness in SQLite therefore has a major impact. The security researchers at Tencent Blade have discovered five vulnerabilities:
- CVE-2019-13734
- CVE-2019-13750
- CVE-2019-13751
- CVE-2019-13752
- CVE-2019-13753
If a software uses SQLite as a component (without the latest patch released on Dec. 13, 2019) and supports external SQL queries, the software is vulnerable. Then remote code execution, a leak in the program memory or program crashes are possible.
If you are using Chrome before 79.0.3945.79 with WebSQL enabled, you may also be affected. Other devices such as PC/mobile devices or IoT devices may also be affected, depending on whether there is a suitable target. However, security researchers have not yet found a public exploit that exploits these vulnerabilities.
Google Chrome 79.0.3945.79 fixes the vulnerabilities
Tencent Blade security researchers have reported all details of the vulnerabilities to Google. Google has fixed the vulnerabilities. If you use Chromium in a software, you should update this program to the official stable version 79.0.3945.79 (Stable Channel Update for Desktop).
Advertising
SQLite has also confirmed and fixed these vulnerabilities. If a product uses SQLite, it should be updated to the latest SQLite code commit. The security researchers do not disclose details of the vulnerabilities at this time and urge vendors to fix this vulnerability as soon as possible. More details can be found in this article.
Advertising
