--- id: CVE-2020-13434 title: >- SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. summary: >- SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. severity: medium cvss: 5.5 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-190 vendor: sqlite product: sqlite affected: - sqlite <= 3.32.0 - debian_linux = 8.0 - debian_linux = 9.0 - fedora = 32 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.10 - ubuntu_linux = 20.04 - 'freebsd >= 11.0, < 11.4' - freebsd = 11.4 - freebsd = 12.0 - freebsd = 12.1 - communications_cloud_native_core_policy = 1.14.0 - 'communications_network_charging_and_control >= 12.0.0, <= 12.0.3' - communications_network_charging_and_control = 6.0.1 - outside_in_technology = 8.5.5 - icloud < 11.5 - itunes < 12.10.9 - ipados < 14.0 - iphone_os < 14.0 - 'macos >= 11.0, < 11.0.1' - tvos < 14.0 - watchos < 7.0 patched: - freebsd 11.4 - icloud 11.5 - itunes 12.10.9 - ipados 14.0 - iphone_os 14.0 - macos 11.0.1 - tvos 14.0 - watchos 7.0 published: '2020-05-24' updated: '2026-10-14' sourceUpdated: '2026-10-14T10:17:26.810' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-13434' references: - url: 'http://seclists.org/fulldisclosure/2020/Dec/32' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Nov/19' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Nov/20' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Nov/22' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/05/msg00024.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ label: cve@mitre.org - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202007-26' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200528-0004/' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211843' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211844' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211850' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211931' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211935' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211952' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4394-1/' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: cve@mitre.org - url: 'https://www.sqlite.org/src/info/23439ea582241138' label: cve@mitre.org - url: 'https://www.sqlite.org/src/info/d08d3405878d394e' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Dec/32' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2020/Nov/19' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2020/Nov/20' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2020/Nov/22' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/05/msg00024.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202007-26' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200528-0004/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211843' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211844' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211850' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211931' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211935' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211952' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4394-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.sqlite.org/src/info/23439ea582241138' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.sqlite.org/src/info/d08d3405878d394e' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.01013 epssPercentile: 0.62261 ingestedAt: '2026-10-14T10:25:41.173Z' --- ## Overview SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. ## Affected - `sqlite <= 3.32.0` - `debian_linux = 8.0` - `debian_linux = 9.0` - `fedora = 32` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.10` - `ubuntu_linux = 20.04` - `freebsd >= 11.0, < 11.4` - `freebsd = 11.4` - `freebsd = 12.0` - `freebsd = 12.1` - `communications_cloud_native_core_policy = 1.14.0` - `communications_network_charging_and_control >= 12.0.0, <= 12.0.3` - `communications_network_charging_and_control = 6.0.1` - `outside_in_technology = 8.5.5` - `icloud < 11.5` - `itunes < 12.10.9` - `ipados < 14.0` - `iphone_os < 14.0` - `macos >= 11.0, < 11.0.1` - `tvos < 14.0` - `watchos < 7.0` ## Remediation Upgrade past the affected range: - `freebsd 11.4` - `icloud 11.5` - `itunes 12.10.9` - `ipados 14.0` - `iphone_os 14.0` - `macos 11.0.1` - `tvos 14.0` - `watchos 7.0`