CVE-2020-13871: sqlite +11 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-13871

CVSS 7.5 · High EPSS 4,4%

Kerentanan Use After Free pada sqlite, fedoraproject fedora +10 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Rincian

Terbit di NVD: 6 Juni 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-416: Use After Free
EPSS (30 hari): 4,4% peluang dieksploitasi; lebih tinggi dari 91,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sqlite	sqlite	Versi 3.32.2
fedoraproject	fedora	Versi 33
debian	debian linux	Versi 9.0
oracle	communications messaging server	Versi 8.1
oracle	communications network charging and control	Versi 6.0.1
oracle	communications network charging and control	Versi 12.0.2
oracle	enterprise manager ops center	Versi 12.4.0.0
oracle	hyperion infrastructure technology	Versi 11.1.2.4
oracle	mysql workbench	Semua versi hingga 8.0.22
oracle	zfs storage appliance kit	Versi 8.8
siemens	sinec infrastructure network services	Semua versi sebelum 1.0.1.1
netapp	cloud backup	Semua versi
netapp	ontap select deploy administration utility	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.sqlite.org/src/info/79eff1d0383179c4 patch · advisory vendor
https://www.sqlite.org/src/info/c8d3b9f0a750a529 exploit · advisory vendor
https://www.sqlite.org/src/info/cd708fa84d2aaaea exploit · advisory vendor
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
https://security.gentoo.org/glsa/202007-26 mitigasi · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html mailing list · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20200619-0002/ advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuApr2021.html advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2021.html advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN32AGQPMHZRN...

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.