CVE-2020-15358

Опубликовано: 27 июн. 2020

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Ссылки

http://seclists.org/fulldisclosure/2020/Dec/32
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/19
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/20
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/22
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2021/Feb/14
Mailing List
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Third Party Advisory
https://security.gentoo.org/glsa/202007-26
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200709-0001/
Third Party Advisory
https://support.apple.com/kb/HT211843
Third Party Advisory
https://support.apple.com/kb/HT211844
Third Party Advisory
https://support.apple.com/kb/HT211847
Third Party Advisory
https://support.apple.com/kb/HT211850
Third Party Advisory
https://support.apple.com/kb/HT211931
Third Party Advisory
https://support.apple.com/kb/HT212147
Third Party Advisory
https://usn.ubuntu.com/4438-1/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Third Party Advisory
https://www.sqlite.org/src/info/10fa79d00f8091e5
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

Версия до 3.32.3 (исключая)

Конфигурация 2

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*

Версия до 7.21 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия до 14.0 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 14.0 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия до 11.0.1 (исключая)

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

Версия до 14.0 (исключая)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Версия до 7.0 (исключая)

Конфигурация 4

Одно из

cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Версия до 8.0.22 (включая)

cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Версия до 1.0.1.1 (исключая)

EPSS

Процентиль: 11%

0.00037

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2020-15358

CVSS3: 5.5

ubuntu

больше 5 лет назад

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

CVE-2020-15358

CVSS3: 5.5

redhat

больше 5 лет назад

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

CVE-2020-15358

CVSS3: 5.5

msrc

почти 5 лет назад

Описание отсутствует

CVE-2020-15358

CVSS3: 5.5

debian

больше 5 лет назад

In SQLite before 3.32.3, select.c mishandles query-flattener optimizat ...

GHSA-rq2p-jfw7-2cj3

CVSS3: 5.5

github

больше 3 лет назад

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

EPSS

Процентиль: 11%

0.00037

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-787