CVE-2020-15358

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-15358
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://seclists.org/fulldisclosure/2020/Dec/32 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/19 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/20 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/22 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2021/Feb/14 Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Third Party Advisory
https://security.gentoo.org/glsa/202007-26 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200709-0001/ Third Party Advisory
https://support.apple.com/kb/HT211843 Third Party Advisory
https://support.apple.com/kb/HT211844 Third Party Advisory
https://support.apple.com/kb/HT211847 Third Party Advisory
https://support.apple.com/kb/HT211850 Third Party Advisory
https://support.apple.com/kb/HT211931 Third Party Advisory
https://support.apple.com/kb/HT212147 Third Party Advisory
https://usn.ubuntu.com/4438-1/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.sqlite.org/src/info/10fa79d00f8091e5 Patch Vendor Advisory
https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2 Patch Vendor Advisory
https://www.sqlite.org/src/tktview?name=8f157e8010 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
History

12 May 2022, 15:01

Type Values Removed Values Added
First Time Oracle communications Cloud Native Core Policy
Siemens sinec Infrastructure Network Services
Siemens
References (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory
CPE cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

20 Apr 2022, 00:15

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html -

18 Apr 2022, 15:21

Type Values Removed Values Added
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html - (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html - Patch, Third Party Advisory
CPE cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
First Time Oracle communications Messaging Server

10 Mar 2022, 17:41

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf -

22 Sep 2021, 14:22

Type Values Removed Values Added
CPE cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

14 Jun 2021, 18:15

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html -

10 Feb 2021, 15:59

Type Values Removed Values Added
CPE cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
References (UBUNTU) https://usn.ubuntu.com/4438-1/ - (UBUNTU) https://usn.ubuntu.com/4438-1/ - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT211844 - (CONFIRM) https://support.apple.com/kb/HT211844 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2020/Dec/32 - (FULLDISC) http://seclists.org/fulldisclosure/2020/Dec/32 - Mailing List, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2020/Nov/22 - (FULLDISC) http://seclists.org/fulldisclosure/2020/Nov/22 - Mailing List, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT212147 - (CONFIRM) https://support.apple.com/kb/HT212147 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2020/Nov/19 - (FULLDISC) http://seclists.org/fulldisclosure/2020/Nov/19 - Mailing List, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2021/Feb/14 - (FULLDISC) http://seclists.org/fulldisclosure/2021/Feb/14 - Mailing List, Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT211843 - (CONFIRM) https://support.apple.com/kb/HT211843 - Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202007-26 - (GENTOO) https://security.gentoo.org/glsa/202007-26 - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT211850 - (CONFIRM) https://support.apple.com/kb/HT211850 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2020/Nov/20 - (FULLDISC) http://seclists.org/fulldisclosure/2020/Nov/20 - Mailing List, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpujan2021.html - (MISC) https://www.oracle.com/security-alerts/cpujan2021.html - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT211847 - (CONFIRM) https://support.apple.com/kb/HT211847 - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT211931 - (CONFIRM) https://support.apple.com/kb/HT211931 - Third Party Advisory

02 Feb 2021, 11:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2021/Feb/14 -

01 Feb 2021, 21:15

Type Values Removed Values Added
References
  • (CONFIRM) https://support.apple.com/kb/HT212147 -

20 Jan 2021, 15:15

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpujan2021.html -
Information

Published : 2020-06-27 12:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-15358

Mitre link : CVE-2020-15358

CVE.ORG link : CVE-2020-15358

JSON object : View

Products Affected

oracle

  • outside_in_technology
  • communications_cloud_native_core_policy
  • communications_network_charging_and_control
  • enterprise_manager_ops_center
  • hyperion_infrastructure_technology
  • mysql
  • communications_messaging_server

apple

  • iphone_os
  • tvos
  • ipados
  • watchos
  • icloud
  • macos

canonical

  • ubuntu_linux

siemens

  • sinec_infrastructure_network_services

sqlite

  • sqlite
CWE
CWE-787

Out-of-bounds Write