Vulnerability Description
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sqlite | Sqlite | < 3.32.3 |
| Canonical | Ubuntu Linux | 20.04 |
| Apple | Icloud | < 7.21 |
| Apple | Ipados | < 14.0 |
| Apple | Iphone Os | < 14.0 |
| Apple | Macos | < 11.0.1 |
| Apple | Tvos | < 14.0 |
| Apple | Watchos | < 7.0 |
| Oracle | Communications Cloud Native Core Policy | 1.14.0 |
| Oracle | Communications Messaging Server | 8.1 |
| Oracle | Communications Network Charging And Control | 6.0.1 |
| Oracle | Enterprise Manager Ops Center | 12.4.0.0 |
| Oracle | Hyperion Infrastructure Technology | 11.1.2.4 |
| Oracle | Mysql | <= 8.0.22 |
| Oracle | Outside In Technology | 8.5.4 |
| Siemens | Sinec Infrastructure Network Services | < 1.0.1.1 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2020/Dec/32Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2020/Nov/19Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2020/Nov/20Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2020/Nov/22Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Feb/14Mailing ListThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfThird Party Advisory
- https://security.gentoo.org/glsa/202007-26Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200709-0001/Third Party Advisory
- https://support.apple.com/kb/HT211843Third Party Advisory
- https://support.apple.com/kb/HT211844Third Party Advisory
- https://support.apple.com/kb/HT211847Third Party Advisory
- https://support.apple.com/kb/HT211850Third Party Advisory
- https://support.apple.com/kb/HT211931Third Party Advisory
- https://support.apple.com/kb/HT212147Third Party Advisory
- https://usn.ubuntu.com/4438-1/Third Party Advisory
FAQ
What is CVE-2020-15358?
CVE-2020-15358 is a vulnerability with a CVSS score of 5.5 (MEDIUM). In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
How severe is CVE-2020-15358?
CVE-2020-15358 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15358?
Check the references section above for vendor advisories and patch information. Affected products include: Sqlite Sqlite, Canonical Ubuntu Linux, Apple Icloud, Apple Ipados, Apple Iphone Os.