IM
IronMonkey Threat Research

CVE-2020-15358 MEDIUM

Published: 2020-06-27 | Last Modified: 2024-11-21 | Status: Modified

Description

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Additional Descriptions (1)

En SQLite versiones anteriores a 3.32.3, el archivo select.c maneja inapropiadamente la optimización query-flattener, conllevando a un desbordamiento de la pila de multiSelectOrderBy debido al uso inapropiado de las propiedades transitivas para la propagación constante

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Base Score: 2.1 (LOW)

AV:L/AC:L/Au:N/C:N/I:N/A:P

Access VectorLOCAL
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
sqlite sqlite * <built-in method update of dict object at 0x7fd36aad2d80> Application
canonical ubuntu_linux 20.04 <built-in method update of dict object at 0x7fd319fa5740> Operating System
apple icloud * <built-in method update of dict object at 0x7fd319fa69c0> Application
apple ipados * <built-in method update of dict object at 0x7fd36aad0780> Operating System
apple iphone_os * <built-in method update of dict object at 0x7fd319fa5cc0> Operating System
apple macos * <built-in method update of dict object at 0x7fd319fa61c0> Operating System
apple tvos * <built-in method update of dict object at 0x7fd340a6de40> Operating System
apple watchos * <built-in method update of dict object at 0x7fd36aad0540> Operating System
oracle communications_cloud_native_core_policy 1.14.0 <built-in method update of dict object at 0x7fd340a6e000> Application
oracle communications_messaging_server 8.1 <built-in method update of dict object at 0x7fd36aad1b00> Application
oracle communications_network_charging_and_control 6.0.1 <built-in method update of dict object at 0x7fd36afa6e00> Application
oracle communications_network_charging_and_control 12.0.2 <built-in method update of dict object at 0x7fd36aad0240> Application
oracle enterprise_manager_ops_center 12.4.0.0 <built-in method update of dict object at 0x7fd319fa76c0> Application
oracle hyperion_infrastructure_technology 11.1.2.4 <built-in method update of dict object at 0x7fd36be63d40> Application
oracle mysql * <built-in method update of dict object at 0x7fd340a6c180> Application
oracle outside_in_technology 8.5.4 <built-in method update of dict object at 0x7fd2a15b8240> Application
oracle outside_in_technology 8.5.5 <built-in method update of dict object at 0x7fd319fa7c00> Application
siemens sinec_infrastructure_network_services * <built-in method update of dict object at 0x7fd36aad1f80> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
Yes cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

References