IM
IronMonkey Threat Research

CVE-2020-13434 MEDIUM

Published: 2020-05-24 | Last Modified: 2024-11-21 | Status: Modified

Description

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

Additional Descriptions (1)

SQLite versiones hasta 3.32.0, presenta un desbordamiento de enteros en la función sqlite3_str_vappendf en el archivo printf.c.

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Base Score: 2.1 (LOW)

AV:L/AC:L/Au:N/C:N/I:N/A:P

Access VectorLOCAL
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-190

Affected Products

Vendor Product Version Update Type
sqlite sqlite * <built-in method update of dict object at 0x7fd3686e99c0> Application
debian debian_linux 8.0 <built-in method update of dict object at 0x7fd36ad787c0> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd36ad78300> Operating System
fedoraproject fedora 32 <built-in method update of dict object at 0x7fd36ad7be80> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd3686e8080> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd3686e9180> Operating System
canonical ubuntu_linux 19.10 <built-in method update of dict object at 0x7fd36ad2aa80> Operating System
canonical ubuntu_linux 20.04 <built-in method update of dict object at 0x7fd340f246c0> Operating System
freebsd freebsd * <built-in method update of dict object at 0x7fd38546aa00> Operating System
freebsd freebsd 11.4 <built-in method update of dict object at 0x7fd3686eba80> Operating System
freebsd freebsd 11.4 <built-in method update of dict object at 0x7fd36ad7a280> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd38419cc40> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd38546ad40> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd38419c900> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd340f25880> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd3840e4c40> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd3840e6900> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd340f25480> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd36ad7ab40> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd36ad7a140> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd3840e4c80> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd38419d800> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd3702e4700> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd36ad799c0> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd340f24680> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd36a003d80> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd385469bc0> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd369f9c240> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd38419c600> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd340f26400> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd36b5bba80> Operating System
freebsd freebsd 12.1 <built-in method update of dict object at 0x7fd3686ea440> Operating System
oracle communications_cloud_native_core_policy 1.14.0 <built-in method update of dict object at 0x7fd340f249c0> Application
oracle communications_network_charging_and_control * <built-in method update of dict object at 0x7fd36b5ba240> Application
oracle communications_network_charging_and_control 6.0.1 <built-in method update of dict object at 0x7fd3686ebc00> Application
oracle outside_in_technology 8.5.5 <built-in method update of dict object at 0x7fd368d36800> Application
apple icloud * <built-in method update of dict object at 0x7fd36b86a700> Application
apple itunes * <built-in method update of dict object at 0x7fd36b86a940> Application
apple ipados * <built-in method update of dict object at 0x7fd36b868700> Operating System
apple iphone_os * <built-in method update of dict object at 0x7fd2a28b21c0> Operating System
apple macos * <built-in method update of dict object at 0x7fd36b86b600> Operating System
apple tvos * <built-in method update of dict object at 0x7fd36b8685c0> Operating System
apple watchos * <built-in method update of dict object at 0x7fd36b86a2c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:11.4:-:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:11.4:p1:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p10:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p11:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p12:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p5:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p7:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p8:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p9:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:p1:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:p2:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:p3:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:p4:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:p5:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:p6:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.1:p7:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
Yes cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
Yes cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

References