{"id":"CVE-2020-13871","aliases":["A-192606047","ASB-A-192606047","BELL-CVE-2020-13871","BIT-sqlite-2020-13871","DEBIAN-CVE-2020-13871","DLA-2340-1","EUVD-2020-6079","GHSA-wjq2-9xcc-v8x3","MGASA-2021-0303","openSUSE-SU-2024:11400-1"],"status":"published","title":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite...","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04447,"percentile":0.91481,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2020-06-06T15:37:37Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":"platform/external/sqlite","fixed_in":["11:2021-11-01"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"sqlite","fixed_in":["3.32.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sqlite3","fixed_in":["3.32.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.32.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.32.2-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":"platform/external/sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-11-01"}]}],"versions":["11"]},{"source":"osv","ecosystem":"Bitnami","package":"sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.32.2"},{"fixed":"3.32.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.2-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.2-5+deb9u2"}]}],"versions":["3.16.2-5","3.16.2-5+deb9u1"],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.1-1.1.mga7"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1.2"}]}],"bundled":10}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"oracle","product":"communications_messaging_server"},{"vendor":"oracle","product":"communications_network_charging_and_control"},{"vendor":"oracle","product":"enterprise_manager_ops_center"},{"vendor":"oracle","product":"hyperion_infrastructure_technology"},{"vendor":"oracle","product":"mysql_workbench"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"https://security.gentoo.org/glsa/202007-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Mitigation","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN32AGQPMHZRNM6P6L5GZPETOWTGXOKP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.sqlite.org/src/info/cd708fa84d2aaaea","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","advisory","evidence"]},{"url":"https://www.sqlite.org/src/info/c8d3b9f0a750a529","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","advisory","evidence"]},{"url":"https://www.sqlite.org/src/info/79eff1d0383179c4","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20200619-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13871","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN32AGQPMHZRNM6P6L5GZPETOWTGXOKP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BN32AGQPMHZRNM6P6L5GZPETOWTGXOKP"},{"url":"https://security.netapp.com/advisory/ntap-20200619-0002"},{"url":"https://github.com/advisories/GHSA-wjq2-9xcc-v8x3"},{"url":"https://source.android.com/security/bulletin/2021-11-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/external/sqlite/+/84500124e617d2548c2b2374eb84a3e0ea8884d1","tags":["fix"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-13871","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13871","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0303.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26270","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4442","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2340","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BN32AGQPMHZRNM6P6L5GZPETOWTGXOKP/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4438-1","tags":["advisory"]},{"url":"https://www.sqlite.org/releaselog/3_32_3.html","tags":["web"]},{"url":"https://www.sqlite.org/releaselog/3_32_2.html","tags":["web"]},{"url":"https://www.sqlite.org/releaselog/3_32_1.html","tags":["web"]},{"url":"https://www.sqlite.org/releaselog/3_32_0.html","tags":["web"]},{"url":"https://usn.ubuntu.com/4394-1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2221","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13871","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13871","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","status":"published","published":"2020-06-06T15:37:37Z","modified":"2026-10-14T09:29:16.827Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2020-6079","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","status":"published","published":"2020-06-06T15:37:37Z","modified":"2026-10-14T09:29:16Z","updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-wjq2-9xcc-v8x3","title":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite...","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","status":"published","published":"2022-05-24T17:19:28Z","modified":"2026-10-14T12:32:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2020-13871","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","status":"published","published":"2020-06-06T16:15:10.543Z","modified":"2026-10-14T10:17:29.33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"BELL-CVE-2020-13871","title":"CVE-2020-13871 does not affect BellSoft software","status":"withdrawn","published":"2020-06-06T16:15:00Z","modified":"2026-01-26T09:48:16.055789Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-13871","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","status":"published","published":"2020-06-06T16:15:10.543Z","modified":"2026-10-24T10:30:33.181991555Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13871","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","status":"published","published":"2020-06-06T16:15:10.543Z","modified":"2026-10-26T12:00:35.074397654Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"ASB-A-192606047","description":"In resetAccumulator of select.c, there is a possible use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2021-11-01T00:00:00Z","modified":"2026-11-05T16:32:28.703711716Z","updated_at":"2026-11-05T17:55:14.774652Z"},{"id":"BIT-sqlite-2020-13871","description":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","status":"published","published":"2024-03-06T11:07:31.077Z","modified":"2026-10-16T09:45:32.038415515Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DLA-2340-1","title":"sqlite3 - security update","status":"published","published":"2020-08-22T00:00:00Z","modified":"2026-03-09T01:23:17.285848Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0303","title":"Updated sqlite3 packages fix security vulnerabilities","description":"In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL\npointer dereference and segmentation fault because of generated column\noptimizations (CVE-2020-9327).\n\nSQLite through 3.31.1 allows attackers to cause a denial of service\n(segmentation fault) via a malformed window-function query because the\nAggInfo object's initialization is mishandled\n(CVE-2020-11655).\n\nSQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in\nprintf.c (CVE-2020-13434).\n\nSQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in\nexpr.c (CVE-2020-13435).\n\next/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow,\nrelated to the snippet feature (CVE-2020-13630).\n\nSQLite before 3.32.0 allows a virtual table to be renamed to the name of one\nof its shadow tables, related to alter.c and build.c (CVE-2020-13631).\n\next/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference\nvia a crafted matchinfo() query (CVE-2020-13632).\n\nSQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the\nparse tree rewrite for window functions is too late (CVE-2020-13871).\n\nIn SQLite before 3.32.3, select.c mishandles query-flattener optimization,\nleading to a multiSelectOrderBy heap overflow because of misuse of transitive\nproperties for constant propagation (CVE-2020-15358).\n","status":"published","published":"2021-06-30T23:58:41Z","modified":"2026-04-16T04:43:20.731127999Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:11400-1","title":"libsqlite3-0-3.36.0-1.2 on GA media","description":"These are all security issues fixed in the libsqlite3-0-3.36.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:18.788761Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}