CVE-2020-9327 - 漏洞详情

CVE-2020-9327 (CNNVD-202002-1070)

HIGH

中文标题:

SQLite 代码问题漏洞

英文标题:

In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and...

CVSS分数: 7.5

发布时间: 2020-02-21 21:25:14

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

SQLite是美国D.Richard Hipp（D.richard Hipp）个人开发者的一套基于C语言的开源嵌入式关系数据库管理系统。该系统具有独立性、隔离性、跨平台等特点。 SQLite 3.31.1版本中的isAuxiliaryVtabOperator存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。

英文描述:

In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.

CWE类型:

CWE-476

受影响产品

厂商	产品	版本	版本范围	平台	CPE
sqlite	sqlite	3.31.1	-	-	`cpe:2.3:a:sqlite:sqlite:3.31.1:::::::*`
netapp	cloud_backup	-	-	-	`cpe:2.3:a:netapp:cloud_backup:-:::::::*`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
canonical	ubuntu_linux	19.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*`
siemens	sinec_infrastructure_network_services	*	-	-	`cpe:2.3:a:siemens:sinec_infrastructure_network_services::::::::`
oracle	communications_network_charging_and_control	*	-	-	`cpe:2.3:a:oracle:communications_network_charging_and_control::::::::`
oracle	communications_network_charging_and_control	6.0.1	-	-	`cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:::::::*`
oracle	communications_network_charging_and_control	12.0.2	-	-	`cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.2:::::::*`
oracle	enterprise_manager_ops_center	12.4.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:::::::*`
oracle	hyperion_infrastructure_technology	11.1.2.4	-	-	`cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:::::::*`
oracle	mysql_workbench	*	-	-	`cpe:2.3:a:oracle:mysql_workbench::::::::`
oracle	outside_in_technology	8.5.4	-	-	`cpe:2.3:a:oracle:outside_in_technology:8.5.4:::::::*`
oracle	outside_in_technology	8.5.5	-	-	`cpe:2.3:a:oracle:outside_in_technology:8.5.5:::::::*`
oracle	zfs_storage_appliance_kit	8.8	-	-	`cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:::::::*`
oracle	communications_messaging_server	8.1	-	-	`cpe:2.3:o:oracle:communications_messaging_server:8.1:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

GLSA-202003-16 vendor-advisory
cve.org

访问

USN-4298-1 vendor-advisory
cve.org

访问