CVE-2020-13630High· 7.0▾ Twilightext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.0%
Last analysed / modified upstream
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
sqlite < 3.32.0fedora = 32ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 19.10ubuntu_linux = 20.04cloud_backupsolidfire,_enterprise_sds_&_hci_storage_nodefabric_operating_systemhci_compute_node_firmwaredebian_linux = 9.0sinec_infrastructure_network_services < 1.0.1.1icloud < 11.5itunes < 12.10.9ipados < 14.0iphone_os < 14.0macos < 11.0.1tvos < 14.0watchos < 7.0communications_network_charging_and_control >= 12.0.0, <= 12.0.3communications_network_charging_and_control = 6.0.1outside_in_technology = 8.5.4outside_in_technology = 8.5.5zfs_storage_appliance_kit = 8.8Upgrade past the affected range:
sqlite 3.32.0sinec_infrastructure_network_services 1.0.1.1icloud 11.5itunes 12.10.9ipados 14.0iphone_os 14.0macos 11.0.1tvos 14.0watchos 7.0Connected by shared product, vendor, weakness, or advisory.
CVE-2019-20218High· 7.5selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
CVE-2019-19242Medium· 5.9SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
CVE-2019-8457Critical· 9.8SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
CVE-2019-5018High· 8.1An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0
CVE-2020-13632Medium· 5.5ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
CVE-2020-13631Medium· 5.5SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.