High severity · published Jun 6, 2020
CVE-2020-13871
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late
7.5
CVSS
4.4%
EPSS
No
On KEV
Description
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
CN
Communications Network Charging And Control · Oracle
6.0.1; 12.0.2 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.4.0.0 · source: NVD
FE
Fedora · Fedoraproject
33 · source: NVD
HI
Hyperion Infrastructure Technology · Oracle
11.1.2.4 · source: NVD
MW
Mysql Workbench · Oracle
through 8.0.22 · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
SI
Sinec Infrastructure Network Services · Siemens
before 1.0.1.1 · source: NVD
SQ
Sqlite · Sqlite
3.32.2 · source: NVD
ZS
Zfs Storage Appliance Kit · Oracle
8.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13871
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Mailing List
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN32AGQPMHZRNM6P6L5GZPETOWTGXOKP/
Mitigation
https://security.gentoo.org/glsa/202007-26
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200619-0002/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability