CVE-2020-13630

HIGH EPSS 59.4%

Published May 27, 20206y ago · Modified Jun 17, 20262w ago

7.0 CVSS 3.1

High

Find Similar

Published May 27, 2020 6y ago

Last Modified Jun 17, 2026 2w ago

Description

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

CVSS Details

Base Score

7.0

Exploitability

1.0

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity High

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

59.4% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 25

Vendor	Product	Version	Range
sqlite	sqlite	*	<3.32.0
fedoraproject	fedora	32	any
canonical	ubuntu_linux	16.04	any
canonical	ubuntu_linux	18.04	any
canonical	ubuntu_linux	19.10	any
canonical	ubuntu_linux	20.04	any
netapp	cloud_backup	*	any
netapp	solidfire\,_enterprise_sds_\&_hci_storage_node	*	any
brocade	fabric_operating_system	*	any
netapp	hci_compute_node_firmware	*	any
netapp	hci_compute_node	*	any
debian	debian_linux	9.0	any
siemens	sinec_infrastructure_network_services	*	<1.0.1.1
apple	icloud	*	<11.5
apple	itunes	*	<12.10.9
apple	ipados	*	<14.0
apple	iphone_os	*	<14.0
apple	macos	*	<11.0.1
apple	tvos	*	<14.0
apple	watchos	*	<7.0
oracle	communications_network_charging_and_control	*	≥12.0.0 – ≤12.0.3
oracle	communications_network_charging_and_control	6.0.1	any
oracle	outside_in_technology	8.5.4	any
oracle	outside_in_technology	8.5.5	any
oracle	zfs_storage_appliance_kit	8.8	any

References 21

seclists.org http://seclists.org/fulldisclosure/2020/Dec/32

Mailing ListThird Party Advisory
seclists.org http://seclists.org/fulldisclosure/2020/Nov/19

Mailing ListThird Party Advisory
seclists.org http://seclists.org/fulldisclosure/2020/Nov/20

Mailing ListThird Party Advisory
seclists.org http://seclists.org/fulldisclosure/2020/Nov/22

Mailing ListThird Party Advisory
bugs.chromium.org https://bugs.chromium.org/p/chromium/issues/detail?id=1080459

Permissions RequiredThird Party Advisory
cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

PatchThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html

Third Party Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/
security.freebsd.org https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc

MitigationThird Party Advisory
security.gentoo.org https://security.gentoo.org/glsa/202007-26

Third Party Advisory
security.netapp.com https://security.netapp.com/advisory/ntap-20200608-0002/

Third Party Advisory
sqlite.org https://sqlite.org/src/info/0d69f76f0865f962

PatchVendor Advisory
support.apple.com https://support.apple.com/kb/HT211843

Release NotesThird Party Advisory
support.apple.com https://support.apple.com/kb/HT211844

Release NotesThird Party Advisory
support.apple.com https://support.apple.com/kb/HT211850

Release NotesThird Party Advisory
support.apple.com https://support.apple.com/kb/HT211931

Release NotesThird Party Advisory
support.apple.com https://support.apple.com/kb/HT211935

Release NotesThird Party Advisory
support.apple.com https://support.apple.com/kb/HT211952

Release NotesThird Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4394-1/

PatchThird Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpujul2020.html

Third Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpuoct2020.html

Third Party Advisory

Remediation

cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

PatchThird Party Advisory
sqlite.org https://sqlite.org/src/info/0d69f76f0865f962

PatchVendor Advisory
usn.ubuntu.com https://usn.ubuntu.com/4394-1/

PatchThird Party Advisory