[email protected]CVE-2020-13871

HistoryJun 06, 2020 - 4:15 p.m.

CVE-2020-13871

2020-06-0616:15:00

CWE-416

[email protected]

web.nvd.nist.gov

232

sqlite

cve-2020-13871

nvd

security

vulnerability

use-after-free

select.c

parse tree rewrite

window functions

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.2%

JSON

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

CPENameOperatorVersion
sqlite:sqlitesqliteeq3.32.2
fedoraproject:fedorafedoraproject fedoraeq33
debian:debian_linuxdebian debian linuxeq9.0
oracle:hyperion_infrastructure_technologyoracle hyperion infrastructure technologyeq11.1.2.4
oracle:enterprise_manager_ops_centeroracle enterprise manager ops centereq12.4.0.0
oracle:communications_network_charging_and_controloracle communications network charging and controleq12.0.2
oracle:communications_network_charging_and_controloracle communications network charging and controleq6.0.1
oracle:zfs_storage_appliance_kitoracle zfs storage appliance kiteq8.8
oracle:communications_messaging_serveroracle communications messaging servereq8.1
oracle:mysql_workbenchoracle mysql workbenchle8.0.22

CPE	Name	Operator	Version
sqlite:sqlite	sqlite	eq	3.32.2
fedoraproject:fedora	fedoraproject fedora	eq	33
debian:debian_linux	debian debian linux	eq	9.0
oracle:hyperion_infrastructure_technology	oracle hyperion infrastructure technology	eq	11.1.2.4
oracle:enterprise_manager_ops_center	oracle enterprise manager ops center	eq	12.4.0.0
oracle:communications_network_charging_and_control	oracle communications network charging and control	eq	12.0.2
oracle:communications_network_charging_and_control	oracle communications network charging and control	eq	6.0.1
oracle:zfs_storage_appliance_kit	oracle zfs storage appliance kit	eq	8.8
oracle:communications_messaging_server	oracle communications messaging server	eq	8.1
oracle:mysql_workbench	oracle mysql workbench	le	8.0.22