Medium severity5.5NVD Advisory· Published Jun 27, 2020· Updated Jun 17, 2026
CVE-2020-15358
CVE-2020-15358
Description
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
60- osv-coords40 versionspkg:apk/chainguard/mysql-8.0-clientpkg:apk/chainguard/mysql-8.0-oci-entrypointpkg:apk/chainguard/mysql-8.0-oci-entrypoint-compatpkg:apk/chainguard/mysql-8.0-bitnami-compatpkg:apk/chainguard/mysql-8.0-iamguarded-compatpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/sqlite3&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/sqlite3&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/sqlite3&distro=SUSE%20Manager%20Server%204.0pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Micro%205.0pkg:rpm/suse/sqlite3&distro=SUSE%20Enterprise%20Storage%206pkg:bitnami/sqlitepkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:apk/chainguard/mysql-8.0-devpkg:rpm/opensuse/sqlite3&distro=openSUSE%20Leap%2015.3pkg:apk/chainguard/mysql-8.0pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/sqlite3&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/sqlite3&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/opensuse/sqlite3&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/sqlite3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2
< 8.0.38-r0+ 39 more
- (no CPE)range: < 8.0.38-r0
- (no CPE)range: < 8.0.38-r0
- (no CPE)range: < 8.0.38-r0
- (no CPE)range: < 8.0.38-r0
- (no CPE)range: < 8.0.38-r0
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.32.3
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 8.0.38-r0
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 8.0.38-r0
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-3.12.1
- (no CPE)range: < 3.36.0-9.18.1
- (no CPE)range: < 3.36.0-lp152.4.3.1
- (no CPE)range: < 3.36.0-3.12.1
- SQLite/SQLitedescription
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*Range: <1.0.1.1
Patches
Vulnerability mechanics
References
22- www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party Advisory
- www.sqlite.org/src/info/10fa79d00f8091e5nvdPatchVendor Advisory
- www.sqlite.org/src/timelinenvdPatchVendor Advisory
- www.sqlite.org/src/tktviewnvdExploitVendor Advisory
- seclists.org/fulldisclosure/2020/Dec/32nvdMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2020/Nov/19nvdMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2020/Nov/20nvdMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2020/Nov/22nvdMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2021/Feb/14nvdMailing ListThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfnvdThird Party Advisory
- security.gentoo.org/glsa/202007-26nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20200709-0001/nvdThird Party Advisory
- support.apple.com/kb/HT211843nvdThird Party Advisory
- support.apple.com/kb/HT211844nvdThird Party Advisory
- support.apple.com/kb/HT211847nvdThird Party Advisory
- support.apple.com/kb/HT211850nvdThird Party Advisory
- support.apple.com/kb/HT211931nvdThird Party Advisory
- support.apple.com/kb/HT212147nvdThird Party Advisory
- usn.ubuntu.com/4438-1/nvdThird Party Advisory
- www.oracle.com/security-alerts/cpujan2021.htmlnvdThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2020.htmlnvdThird Party Advisory
News mentions
1- ABB B&R Automation StudioCISA ICS Advisories