CVE-2020-15358

Published: Jun 27, 2020Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Affected (18)

Products: Sqlite: Sqlite · Canonical: Ubuntu Linux · Apple: Icloud, Ipados, Iphone Os, Macos, Tvos, Watchos · +2 more

Show all products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sqlite Sqlite	Before 3.32.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 20.04

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Apple Icloud	Before 7.21
Apple Ipados	Before 14.0
Apple Iphone Os	Before 14.0
Apple Macos	Before 11.0.1
Apple Tvos	Before 14.0
Apple Watchos	Before 7.0

Configuration D

9 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Messaging Server	Version 8.1
Oracle Communications Network Charging And Control	Version 12.0.2
Oracle Communications Network Charging And Control	Version 6.0.1
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Hyperion Infrastructure Technology	Version 11.1.2.4
Oracle Mysql	Up to 8.0.22
Oracle Outside In Technology	Version 8.5.4
Oracle Outside In Technology	Version 8.5.5

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Infrastructure Network Services	Before 1.0.1.1

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (44)

http://seclists.org/fulldisclosure/2020/Dec/32

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2020/Nov/19

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2020/Nov/20

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2020/Nov/22

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2021/Feb/14

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/202007-26

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200709-0001/

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211843

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211844

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211847

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211850

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211931

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT212147

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4438-1/

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

Third Party Advisory

https://www.sqlite.org/src/info/10fa79d00f8091e5

Source: cve@mitre.org

PatchVendor Advisory

https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2

Source: cve@mitre.org

PatchVendor Advisory

https://www.sqlite.org/src/tktview?name=8f157e8010

Source: cve@mitre.org

ExploitVendor Advisory

http://seclists.org/fulldisclosure/2020/Dec/32