CVE-2020-15358

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 27-06-2020 02:15

Last modified: - 12-05-2022 05:01

Total changes: - 12

Description

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Low

Attack complexity

Local

Attack vector

High

Availability

None

Confidentiality

None

Integrity

Low

Privileges required

Unchanged

Scope

None

User interaction

5.5

Base score

1.8

3.6

Exploitability score

Impact score

Verification logic

vendor=sqlite AND product=sqlite AND versionEndExcluding=3.32.3

vendor=canonical AND product=ubuntu_linux AND version=20.04 AND software_edition=lts

vendor=apple AND product=iphone_os AND versionEndExcluding=14.0

vendor=apple AND product=watchos AND versionEndExcluding=7.0

vendor=apple AND product=icloud AND target_software=windows AND versionEndExcluding=7.21

vendor=apple AND product=tvos AND versionEndExcluding=14.0

vendor=apple AND product=ipados AND versionEndExcluding=14.0

vendor=apple AND product=macos AND versionEndExcluding=11.0.1

vendor=oracle AND product=outside_in_technology AND version=8.5.4

vendor=oracle AND product=outside_in_technology AND version=8.5.5

vendor=oracle AND product=hyperion_infrastructure_technology AND version=11.1.2.4

vendor=oracle AND product=enterprise_manager_ops_center AND version=12.4.0.0

vendor=oracle AND product=communications_network_charging_and_control AND version=12.0.2

vendor=oracle AND product=mysql AND versionEndIncluding=8.0.22

vendor=oracle AND product=communications_network_charging_and_control AND version=6.0.1

vendor=oracle AND product=communications_messaging_server AND version=8.1

vendor=oracle AND product=communications_cloud_native_core_policy AND version=1.14.0

vendor=siemens AND product=sinec_infrastructure_network_services AND versionEndExcluding=1.0.1.1

Reference

https://www.sqlite.org/src/info/10fa79d00f8091e5
https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2
https://www.sqlite.org/src/tktview?name=8f157e8010
https://security.netapp.com/advisory/ntap-20200709-0001/
GLSA-202007-26-Third Party Advisory
USN-4438-1-Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT211844
https://support.apple.com/kb/HT211850
https://support.apple.com/kb/HT211843
https://support.apple.com/kb/HT211847
20201115 APPLE-SA-2020-11-13-4 Additional information for APPLE-SA-2020-09-16-2 tvOS 14.0-Mailing List, Third Party Advisory
20201115 APPLE-SA-2020-11-13-6 Additional information for APPLE-SA-2020-09-16-4 watchOS 7.0-Mailing List, Third Party Advisory
20201115 APPLE-SA-2020-11-13-3 Additional information for APPLE-SA-2020-09-16-1 iOS 14.0 and iPadOS 14.0-Mailing List, Third Party Advisory
20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1-Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
https://support.apple.com/kb/HT212147
20210201 APPLE-SA-2021-02-01-1 macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave-Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://www.oracle.com/security-alerts/cpuapr2022.html

Keywords

CVE-2020-15358

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2020-15358

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures