Vulnerability Details : CVE-2020-13434
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
Vulnerability category: Overflow
Exploit prediction scoring system (EPSS) score for CVE-2020-13434
Probability of exploitation activity in the next 30 days: 0.13%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 47 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2020-13434
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2020-13434
-
The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-13434
-
http://seclists.org/fulldisclosure/2020/Dec/32
Full Disclosure: APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1Mailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/
[SECURITY] Fedora 32 Update: sqlite-3.32.1-1.fc32 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuapr2022.html
Oracle Critical Patch Update Advisory - April 2022Patch;Third Party Advisory
-
https://www.oracle.com/security-alerts/cpujul2020.html
Oracle Critical Patch Update Advisory - July 2020Patch;Third Party Advisory
-
https://support.apple.com/kb/HT211844
Third Party Advisory
-
http://seclists.org/fulldisclosure/2020/Nov/22
Full Disclosure: APPLE-SA-2020-11-13-6 Additional information for APPLE-SA-2020-09-16-4 watchOS 7.0Mailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
[SECURITY] [DLA 2340-1] sqlite3 security updateMailing List;Third Party Advisory
-
https://usn.ubuntu.com/4394-1/
USN-4394-1: SQLite vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/05/msg00024.html
[SECURITY] [DLA 2221-1] sqlite3Mailing List;Third Party Advisory
-
https://support.apple.com/kb/HT211850
About the security content of iOS 14.0 and iPadOS 14.0 - Apple SupportThird Party Advisory
-
https://support.apple.com/kb/HT211952
About the security content of iTunes 12.10.9 for Windows - Apple SupportThird Party Advisory
-
https://www.oracle.com/security-alerts/cpuApr2021.html
Oracle Critical Patch Update Advisory - April 2021Patch;Third Party Advisory
-
https://support.apple.com/kb/HT211843
About the security content of tvOS 14.0 - Apple SupportThird Party Advisory
-
https://www.sqlite.org/src/info/23439ea582241138
SQLite: View TicketExploit;Patch;Vendor Advisory
-
https://support.apple.com/kb/HT211931
About the security content of macOS Big Sur 11.0.1 - Apple SupportThird Party Advisory
-
http://seclists.org/fulldisclosure/2020/Nov/20
Full Disclosure: APPLE-SA-2020-11-13-3 Additional information for APPLE-SA-2020-09-16-1 iOS 14.0 and iPadOS 14.0Mailing List;Third Party Advisory
-
https://support.apple.com/kb/HT211935
About the security content of iCloud for Windows 11.5 - Apple SupportThird Party Advisory
-
https://security.gentoo.org/glsa/202007-26
SQLite: Multiple vulnerabilities (GLSA 202007-26) — Gentoo securityThird Party Advisory
-
http://seclists.org/fulldisclosure/2020/Nov/19
Full Disclosure: APPLE-SA-2020-11-13-4 Additional information for APPLE-SA-2020-09-16-2 tvOS 14.0Mailing List;Third Party Advisory
-
https://www.sqlite.org/src/info/d08d3405878d394e
SQLite: Check-in [d08d3405]Patch;Vendor Advisory
-
https://security.netapp.com/advisory/ntap-20200528-0004/
May 2020 SQLite Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
Third Party Advisory
Products affected by CVE-2020-13434
- cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p10:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p11:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p12:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p7:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p8:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p9:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.4:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.4:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:p6:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.1:p7:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
- cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*
- Oracle » Communications Network Charging And ControlVersions from including (>=) 12.0.0 and up to, including, (<=) 12.0.3cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*