Vulnerability · Published May 27, 2020 · Assigned by mitre
CVE-2020-13630
High 7.0
In plain English
A high-severity security flaw in the mingw-binutils-generic package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.0High
Exploit odds (30 days)1.0%top 36.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | mingw-binutils-generic | 2.30-3.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw-filesystem-base | 104-2.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-binutils | 2.30-3.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-bzip2 | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-bzip2-static | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-filesystem | 104-2.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-sqlite | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw32-sqlite-static | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-binutils | 2.30-3.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-bzip2 | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-bzip2-static | 1.0.6-14.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-filesystem | 104-2.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-sqlite | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| AlmaLinux:8 | mingw64-sqlite-static | 3.26.0.0-1.el8 | ALSA-2021:1968 |
| Debian:12 | sqlite3 | 3.32.0-1 | DEBIAN-CVE-2020-13630 |
| Debian:13 | sqlite3 | 3.32.0-1 | DEBIAN-CVE-2020-13630 |
| Debian:14 | sqlite3 | 3.32.0-1 | DEBIAN-CVE-2020-13630 |
| Rocky Linux:8 | mingw-binutils | 0:2.30-3.el8 | RLSA-2021:1968 |
| Rocky Linux:8 | mingw-bzip2 | 0:1.0.6-14.el8 | RLSA-2021:1968 |
| Rocky Linux:8 | mingw-sqlite | 0:3.26.0.0-1.el8 | RLSA-2021:1968 |
Affected products (as reported)
References
- FEDORA-2020-0477f8840e vendor-advisory, x_refsource_FEDORA
- USN-4394-1 vendor-advisory, x_refsource_UBUNTU
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- https://bugs.chromium.org/p/chromium/issues/detail?id=1080459 x_refsource_MISC
- https://sqlite.org/src/info/0d69f76f0865f962 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200608-0002/ x_refsource_CONFIRM
- GLSA-202007-26 vendor-advisory, x_refsource_GENTOO
- FreeBSD-SA-20:22 vendor-advisory, x_refsource_FREEBSD
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2340-1] sqlite3 security update mailing-list, x_refsource_MLIST
- https://support.apple.com/kb/HT211843 x_refsource_CONFIRM
- https://support.apple.com/kb/HT211850 x_refsource_CONFIRM
- https://support.apple.com/kb/HT211844 x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC
- https://support.apple.com/kb/HT211931 x_refsource_CONFIRM
- https://support.apple.com/kb/HT211952 x_refsource_CONFIRM
- 20201115 APPLE-SA-2020-11-13-4 Additional information for APPLE-SA-2020-09-16-2 tvOS 14.0 mailing-list, x_refsource_FULLDISC
- 20201115 APPLE-SA-2020-11-13-3 Additional information for APPLE-SA-2020-09-16-1 iOS 14.0 and iPadOS 14.0 mailing-list, x_refsource_FULLDISC
- 20201115 APPLE-SA-2020-11-13-6 Additional information for APPLE-SA-2020-09-16-4 watchOS 7.0 mailing-list, x_refsource_FULLDISC
- https://support.apple.com/kb/HT211935 x_refsource_CONFIRM
- 20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1 mailing-list, x_refsource_FULLDISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html