CVE-2020-15358

Name: CVE-2020-15358
Creator: NVD / NIST
Published: 2020-06-27T12:15:11.187+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.5/10EPSS 1.03%

Last modified Jun 17, 2026

CVE-2020-15358 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.. EPSS estimates a 1.03% chance of exploitation in the next 30 days.

Description

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Metrics

CVSS 3.1

5.5/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

1.03%

59.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-787

Affected Software

Vendor	Product	Versions
Sqlite	Sqlite	< 3.32.3
Canonical	Ubuntu Linux	20.04
Apple	Icloud	< 7.21
Apple	Ipados	< 14.0
Apple	Iphone Os	< 14.0
Apple	Macos	< 11.0.1
Apple	Tvos	< 14.0
Apple	Watchos	< 7.0
Oracle	Communications Cloud Native Core Policy	1.14.0
Oracle	Communications Messaging Server	8.1
Oracle	Communications Network Charging And Control	6.0.1
Oracle	Communications Network Charging And Control	12.0.2
Oracle	Enterprise Manager Ops Center	12.4.0.0
Oracle	Hyperion Infrastructure Technology	11.1.2.4
Oracle	Mysql	<= 8.0.22
Oracle	Outside In Technology	8.5.4
Oracle	Outside In Technology	8.5.5
Siemens	Sinec Infrastructure Network Services	< 1.0.1.1

References

http://seclists.org/fulldisclosure/2020/Dec/32Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/19Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/20Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/22Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Feb/14Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfThird Party Advisory
https://security.gentoo.org/glsa/202007-26Third Party Advisory
https://security.netapp.com/advisory/ntap-20200709-0001/Third Party Advisory
https://support.apple.com/kb/HT211843Third Party Advisory
https://support.apple.com/kb/HT211844Third Party Advisory
https://support.apple.com/kb/HT211847Third Party Advisory
https://support.apple.com/kb/HT211850Third Party Advisory
https://support.apple.com/kb/HT211931Third Party Advisory
https://support.apple.com/kb/HT212147Third Party Advisory
https://usn.ubuntu.com/4438-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://www.sqlite.org/src/info/10fa79d00f8091e5Patch, Vendor Advisory
https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2Patch, Vendor Advisory
https://www.sqlite.org/src/tktview?name=8f157e8010Exploit, Vendor Advisory
http://seclists.org/fulldisclosure/2020/Dec/32Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/19Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/20Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/22Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Feb/14Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfThird Party Advisory
https://security.gentoo.org/glsa/202007-26Third Party Advisory
https://security.netapp.com/advisory/ntap-20200709-0001/Third Party Advisory
https://support.apple.com/kb/HT211843Third Party Advisory
https://support.apple.com/kb/HT211844Third Party Advisory
https://support.apple.com/kb/HT211847Third Party Advisory
https://support.apple.com/kb/HT211850Third Party Advisory
https://support.apple.com/kb/HT211931Third Party Advisory
https://support.apple.com/kb/HT212147Third Party Advisory
https://usn.ubuntu.com/4438-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://www.sqlite.org/src/info/10fa79d00f8091e5Patch, Vendor Advisory
https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2Patch, Vendor Advisory
https://www.sqlite.org/src/tktview?name=8f157e8010Exploit, Vendor Advisory

Timeline

Published: Jun 27, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-15358?

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

How severe is CVE-2020-15358?

CVE-2020-15358 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 1.03% probability of exploitation in the next 30 days.

How do I fix CVE-2020-15358?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-15358?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST