{"schema_version":"1.8.0","id":"CVE-2020-13871","published":"2020-06-06T16:15:10.543Z","modified":"2026-08-07T11:30:59.187359271Z","aliases":["A-192606047","ASB-A-192606047","BIT-sqlite-2020-13871"],"related":["openSUSE-SU-2024:11400-1"],"details":"SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sqlite/sqlite","events":[{"introduced":"fc6d94658674d388f5dadfa416850026459b7360"},{"last_affected":"fc6d94658674d388f5dadfa416850026459b7360"}],"database_specific":{"cpe":"cpe:2.3:a:sqlite:sqlite:3.32.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.32.2"},{"last_affected":"3.32.2"}],"source":"CPE_STRING"}}],"versions":["3.32.2","version-3.32.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13871.json"}}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN32AGQPMHZRNM6P6L5GZPETOWTGXOKP/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202007-26"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20200619-0002/"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"FIX","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"},{"type":"FIX","url":"https://www.sqlite.org/src/info/79eff1d0383179c4"},{"type":"EVIDENCE","url":"https://www.sqlite.org/src/info/c8d3b9f0a750a529"},{"type":"EVIDENCE","url":"https://www.sqlite.org/src/info/cd708fa84d2aaaea"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"8.0.22"}],"source":"CPE_RANGE","vendor_product":"oracle:mysql_workbench"},{"cpes":["cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"1.0.1.1"}],"source":"CPE_RANGE","vendor_product":"siemens:sinec_infrastructure_network_services"},{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"33"},{"last_affected":"33"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"},{"cpes":["cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.1"},{"last_affected":"8.1"}],"source":"CPE_STRING","vendor_product":"oracle:communications_messaging_server"},{"cpes":["cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0.1"},{"last_affected":"6.0.1"},{"introduced":"12.0.2"},{"last_affected":"12.0.2"}],"source":"CPE_STRING","vendor_product":"oracle:communications_network_charging_and_control"},{"cpes":["cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.4.0.0"},{"last_affected":"12.4.0.0"}],"source":"CPE_STRING","vendor_product":"oracle:enterprise_manager_ops_center"},{"cpes":["cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.1.2.4"},{"last_affected":"11.1.2.4"}],"source":"CPE_STRING","vendor_product":"oracle:hyperion_infrastructure_technology"},{"cpes":["cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.8"},{"last_affected":"8.8"}],"source":"CPE_STRING","vendor_product":"oracle:zfs_storage_appliance_kit"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}