CVE-2020-11655 (NVD)

2020-04-09

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

Products Ubuntu_linux, Debian_linux, Ontap_select_deploy_administration_utility, Communications_element_manager, Communications_messaging_server, Communications_network_charging_and_control, Communications_session_report_manager, Communications_session_route_manager, Enterprise_manager_ops_center, Hyperion_infrastructure_technology, Instantis_enterprisetrack, Mysql, Mysql_workbench, Outside_in_technology, Zfs_storage_appliance_kit, Sinec_infrastructure_network_services, Sqlite, Tenable\.sc
Type Improper Initialization (CWE-665)
First patch - None (likely due to unavailable code)
Links • https://www.oracle.com/security-alerts/cpuApr2021.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11