Heap Overflow in SQLite Due to Query Optimization Mismanagement

CVE-2020-15358

What is CVE-2020-15358?

An issue in SQLite versions prior to 3.32.3 exposes applications to potential heap overflow vulnerabilities. A problem in the handling of query-flattener optimization in the select.c file can lead to a multiSelectOrderBy heap overflow due to improper use of transitive properties for constant propagation. This mismanagement creates an opportunity for attackers to exploit the overflow, potentially executing arbitrary code or compromising the integrity and availability of the database systems relying on SQLite.

References