peter bassill · operator
$ cve CVE-2020-11656 JSON

CVE-2020-11656

9.8
CRITICAL · CVSS 3.1 · EPSS 7.6% (pctl 94)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS7.61% — more likely to be exploited than 94% of all CVEs
WeaknessCWE-416
On CISA KEVno
Public exploitnone known
Published2020-04-09
Last modified2026-06-17

Affected (12)

VendorProduct
netappontap select deploy administration utility
oraclecommunications messaging server
oraclecommunications network charging and control
oracleenterprise manager ops center
oraclehyperion infrastructure technology
oraclemysql
oraclemysql workbench
oracleoutside in technology
oraclezfs storage appliance kit
siemenssinec infrastructure network services
sqlitesqlite
tenabletenable.sc

References

→ the Explorer  ·  watch your stack  ·  NVD