CVE-2020-15358

MEDIUM severity · CVSS 5.5 · Out-of-bounds write

5.5CVSS MEDIUM

Summary

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Impact & exploitability

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)0%

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products we track (1)

MySQL

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
http://seclists.org/fulldisclosure/2020/Dec/32Advisory
http://seclists.org/fulldisclosure/2020/Nov/19Advisory
http://seclists.org/fulldisclosure/2020/Nov/20Advisory
http://seclists.org/fulldisclosure/2020/Nov/22Advisory
http://seclists.org/fulldisclosure/2021/Feb/14Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfAdvisory
https://security.gentoo.org/glsa/202007-26Advisory
https://security.netapp.com/advisory/ntap-20200709-0001/Advisory