--- id: CVE-2020-13632 title: >- ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. summary: >- ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. severity: medium cvss: 5.5 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-476 vendor: sqlite product: sqlite affected: - sqlite < 3.32.0 - fedora = 32 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.10 - ubuntu_linux = 20.04 - cloud_backup - 'solidfire,_enterprise_sds_&_hci_storage_node' - fabric_operating_system - hci_compute_node_firmware - debian_linux = 9.0 - sinec_infrastructure_network_services < 1.0.1.1 - 'communications_network_charging_and_control >= 12.0.0, <= 12.0.3' - communications_network_charging_and_control = 6.0.1 - outside_in_technology = 8.5.4 - outside_in_technology = 8.5.5 - zfs_storage_appliance_kit = 8.8 patched: - sqlite 3.32.0 - sinec_infrastructure_network_services 1.0.1.1 published: '2020-05-27' updated: '2026-10-14' sourceUpdated: '2026-10-14T10:17:28.697' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-13632' references: - url: 'https://bugs.chromium.org/p/chromium/issues/detail?id=1080459' label: cve@mitre.org - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ label: cve@mitre.org - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202007-26' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200608-0002/' label: cve@mitre.org - url: 'https://sqlite.org/src/info/a4dd148928ea65bd' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4394-1/' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: cve@mitre.org - url: 'https://bugs.chromium.org/p/chromium/issues/detail?id=1080459' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202007-26' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200608-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://sqlite.org/src/info/a4dd148928ea65bd' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4394-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-389290.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-13632.json - url: 'https://access.redhat.com/security/cve/CVE-2020-13632' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1841574' - url: 'https://www.cve.org/CVERecord?id=CVE-2020-13632' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-13632' - url: 'https://access.redhat.com/errata/RHSA-2020:4442' - url: 'https://access.redhat.com/errata/RHSA-2021:1968' - url: 'https://access.redhat.com/errata/RHSA-2025:16504' tags: - nvd - csaf - vex - red-hat epss: 0.00571 epssPercentile: 0.4575 ingestedAt: '2026-10-13T18:41:42.716Z' --- ## Overview ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. ## Affected - `sqlite < 3.32.0` - `fedora = 32` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.10` - `ubuntu_linux = 20.04` - `cloud_backup` - `solidfire,_enterprise_sds_&_hci_storage_node` - `fabric_operating_system` - `hci_compute_node_firmware` - `debian_linux = 9.0` - `sinec_infrastructure_network_services < 1.0.1.1` - `communications_network_charging_and_control >= 12.0.0, <= 12.0.3` - `communications_network_charging_and_control = 6.0.1` - `outside_in_technology = 8.5.4` - `outside_in_technology = 8.5.5` - `zfs_storage_appliance_kit = 8.8` ## Remediation Upgrade past the affected range: - `sqlite 3.32.0` - `sinec_infrastructure_network_services 1.0.1.1` ## Vendor advisories - **RHSA-2020:4442** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2020:4442) - **RHSA-2021:1968** · Red Hat · fixed in: Red Hat CodeReady Linux Builder (v. 8) · released 2021-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2021:1968) - **RHSA-2025:16504** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.19 · released 2025-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2025:16504) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6 · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-13632.json)