CVE-2020-9327

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-9327
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch Third Party Advisory
https://security.gentoo.org/glsa/202003-16 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200313-0002/ Third Party Advisory
https://usn.ubuntu.com/4298-1/ Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch Third Party Advisory
https://www.sqlite.org/cgi/src/info/4374860b29383380 Vendor Advisory
https://www.sqlite.org/cgi/src/info/9d0d4ab95dc0c56e Patch Vendor Advisory
https://www.sqlite.org/cgi/src/info/abc473fb8fb99900 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlite:sqlite:3.31.1:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
History

08 Apr 2022, 10:33

Type Values Removed Values Added
First Time Siemens
Oracle outside In Technology
Oracle
Oracle hyperion Infrastructure Technology
Oracle mysql Workbench
Canonical ubuntu Linux
Netapp
Oracle enterprise Manager Ops Center
Canonical
Oracle communications Network Charging And Control
Netapp cloud Backup
Siemens sinec Infrastructure Network Services
Oracle communications Messaging Server
Oracle zfs Storage Appliance Kit
CPE cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
References (MISC) https://www.sqlite.org/cgi/src/info/9d0d4ab95dc0c56e - Vendor Advisory (MISC) https://www.sqlite.org/cgi/src/info/9d0d4ab95dc0c56e - Patch, Vendor Advisory
References (GENTOO) https://security.gentoo.org/glsa/202003-16 - (GENTOO) https://security.gentoo.org/glsa/202003-16 - Third Party Advisory
References (MISC) https://www.sqlite.org/cgi/src/info/abc473fb8fb99900 - Vendor Advisory (MISC) https://www.sqlite.org/cgi/src/info/abc473fb8fb99900 - Patch, Vendor Advisory
References (UBUNTU) https://usn.ubuntu.com/4298-1/ - (UBUNTU) https://usn.ubuntu.com/4298-1/ - Patch, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20200313-0002/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20200313-0002/ - Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpujan2021.html - (MISC) https://www.oracle.com/security-alerts/cpujan2021.html - Patch, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html - (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html - Patch, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpujul2020.html - (MISC) https://www.oracle.com/security-alerts/cpujul2020.html - Patch, Third Party Advisory
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - Patch, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - Patch, Third Party Advisory

10 Mar 2022, 17:41

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf -

14 Jun 2021, 18:15

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html -

20 Jan 2021, 15:15

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpujan2021.html -
Information

Published : 2020-02-21 22:15

Updated : 2023-12-10 13:13

NVD link : CVE-2020-9327

Mitre link : CVE-2020-9327

CVE.ORG link : CVE-2020-9327

JSON object : View

Products Affected

sqlite

  • sqlite

oracle

  • zfs_storage_appliance_kit
  • enterprise_manager_ops_center
  • hyperion_infrastructure_technology
  • communications_messaging_server
  • communications_network_charging_and_control
  • outside_in_technology
  • mysql_workbench

siemens

  • sinec_infrastructure_network_services

netapp

  • cloud_backup

canonical

  • ubuntu_linux
CWE
CWE-476

NULL Pointer Dereference