This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-13871 →
DEBIAN-CVE-2020-13871
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
Original description
The description as published by the source.
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
sqlite3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.2-2"}]}]
Debian:13
sqlite3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.2-2"}]}]
Debian:14
sqlite3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.2-2"}]}]
References
- advisory security-tracker.debian.org