Arch Linux Security Advisory ASA-202006-11

Severity: High
Date : 2020-06-28
CVE-ID : CVE-2020-13871
Package : sqlite
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-1182

Summary

The package sqlite before version 3.32.3-1 is vulnerable to arbitrary
code execution.

Resolution

Upgrade to 3.32.3-1.

pacman -Syu “sqlite>=3.32.3-1”

The problem has been fixed upstream in version 3.32.3.

Workaround

None.

Description

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c
because the parse tree rewrite for window functions is too late.

Impact

An attacker might be able to crash the application or execute arbitrary
code by running a crafted query.

References

https://www.sqlite.org/src/info/c8d3b9f0a750a529
https://www.sqlite.org/src/info/cd708fa84d2aaaea
https://www.sqlite.org/src/info/44a58d6cb135a104
https://security.archlinux.org/CVE-2020-13871