Unscored CVE-2020-13871 EUVD-2020-6079GHSA-wjq2-9xcc-v8x3

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Published Jun 6, 2020 · Updated Oct 14, 2026 · Assigned by mitre

Package: sqlite3 Ecosystem: Debian

Description

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	sqlite3	3.32.2-2	—
Debian 13	sqlite3	3.32.2-2	—
Debian 12	sqlite3	3.32.2-2	—
Debian 9	sqlite3	3.16.2-5+deb9u2	DLA-2340-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	sqlite3	3.36.0-1.2	openSUSE-SU-2024:11400-1

Advisories 8

SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
DLA-2340-1 sqlite3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
openSUSE-SU-2024:11400-1 libsqlite3-0-3.36.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
ICSA-22-069-09 Siemens SINEC INS CISA ICS & IT advisories · May 6, 2025
WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
WID-SEC-2023-0067 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2023
SSA-389290 SSA-389290: Third-Party Component Vulnerabilities in SINEC INS Siemens ProductCERT · Mar 8, 2022

References