Sqlite
CVE-2020-13435
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
AnalysisAI
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. Affected products include: Sqlite, Fedoraproject Fedora. Version information: through 3.32.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.
Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u
Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing t
Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow)
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases wh
SQLite's zipfile extension contains a bug in the zipfileInflate function that leaks heap memory contents when processing
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today