CVE Vulnerabilities

CVE-2020-13630

Use After Free

Published: May 27, 2020 | Modified: Nov 21, 2024
CVSS 3.x
7
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.4 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
7 MODERATE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Sqlite Sqlite * 3.32.0 (excluding)
Red Hat Enterprise Linux 8 RedHat sqlite-0:3.26.0-11.el8 *
Red Hat Enterprise Linux 8 RedHat mingw-binutils-0:2.30-3.el8 *
Red Hat Enterprise Linux 8 RedHat mingw-bzip2-0:1.0.6-14.el8 *
Red Hat Enterprise Linux 8 RedHat mingw-filesystem-0:104-2.el8 *
Red Hat Enterprise Linux 8 RedHat mingw-sqlite-0:3.26.0.0-1.el8 *
Red Hat Enterprise Linux 8 RedHat sqlite-0:3.26.0-11.el8 *
Sqlite3 Ubuntu bionic *
Sqlite3 Ubuntu devel *
Sqlite3 Ubuntu eoan *
Sqlite3 Ubuntu esm-infra/bionic *
Sqlite3 Ubuntu esm-infra/focal *
Sqlite3 Ubuntu esm-infra/xenial *
Sqlite3 Ubuntu focal *
Sqlite3 Ubuntu trusty *
Sqlite3 Ubuntu upstream *
Sqlite3 Ubuntu xenial *

Potential Mitigations

References