Vulnerability · Published May 24, 2020 · Assigned by mitre
CVE-2020-13434
Medium 5.5
In plain English
A medium-severity security flaw in the mingw-binutils-generic package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.0%top 36.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | mingw-binutils-generic | 2.30-3.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw-filesystem-base | 104-2.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-binutils | 2.30-3.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-bzip2 | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-bzip2-static | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-filesystem | 104-2.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-sqlite | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-sqlite-static | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-binutils | 2.30-3.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-bzip2 | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-bzip2-static | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-filesystem | 104-2.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-sqlite | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-sqlite-static | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| Alpine:v3.20 | sqlite | 3.32.1-r0 | ALPINE-CVE-2020-13434 |
| Alpine:v3.21 | sqlite | 3.32.1-r0 | ALPINE-CVE-2020-13434 |
| Alpine:v3.22 | sqlite | 3.32.1-r0 | ALPINE-CVE-2020-13434 |
| Alpine:v3.23 | sqlite | 3.32.1-r0 | ALPINE-CVE-2020-13434 |
| Alpine:v3.24 | sqlite | 3.32.1-r0 | ALPINE-CVE-2020-13434 |
| Debian:12 | sqlite3 | 3.32.1-1 | DEBIAN-CVE-2020-13434 |
| Debian:13 | sqlite3 | 3.32.1-1 | DEBIAN-CVE-2020-13434 |
| Debian:14 | sqlite3 | 3.32.1-1 | DEBIAN-CVE-2020-13434 |
| Rocky Linux:8 | mingw-binutils | 0:2.30-3.el8 | RLSA-2021:1968 |
| Rocky Linux:8 | mingw-bzip2 | 0:1.0.6-14.el8 | RLSA-2021:1968 |
| Rocky Linux:8 | mingw-sqlite | 0:3.26.0.0-1.el8 | RLSA-2021:1968 |
| Rocky Linux:8 | sqlite | 0:3.26.0-13.el8 | RLSA-2021:1581 |
Affected products (as reported)
References
- [debian-lts-announce] 20200526 [SECURITY] [DLA 2221-1] sqlite3 mailing-list, x_refsource_MLIST
- FEDORA-2020-0477f8840e vendor-advisory, x_refsource_FEDORA
- USN-4394-1 vendor-advisory, x_refsource_UBUNTU
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- https://www.sqlite.org/src/info/23439ea582241138 x_refsource_MISC
- https://www.sqlite.org/src/info/d08d3405878d394e x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200528-0004/ x_refsource_CONFIRM
- GLSA-202007-26 vendor-advisory, x_refsource_GENTOO
- FreeBSD-SA-20:22 vendor-advisory, x_refsource_FREEBSD
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2340-1] sqlite3 security update mailing-list, x_refsource_MLIST
- 20201115 APPLE-SA-2020-11-13-4 Additional information for APPLE-SA-2020-09-16-2 tvOS 14.0 mailing-list, x_refsource_FULLDISC
- 20201115 APPLE-SA-2020-11-13-3 Additional information for APPLE-SA-2020-09-16-1 iOS 14.0 and iPadOS 14.0 mailing-list, x_refsource_FULLDISC
- 20201115 APPLE-SA-2020-11-13-6 Additional information for APPLE-SA-2020-09-16-4 watchOS 7.0 mailing-list, x_refsource_FULLDISC
- 20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1 mailing-list, x_refsource_FULLDISC
- https://support.apple.com/kb/HT211843 x_refsource_CONFIRM
- https://support.apple.com/kb/HT211850 x_refsource_CONFIRM
- https://support.apple.com/kb/HT211844 x_refsource_CONFIRM
- https://support.apple.com/kb/HT211931 x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://support.apple.com/kb/HT211952 x_refsource_CONFIRM
- https://support.apple.com/kb/HT211935 x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html