Lucene search
IBME266F803E71C486543CF623D66DDFA40AA2C4AEB0C15F49A79A5600D3D37709BHistorySep 22, 2020 - 2:34 a.m.
Security Bulletin: A vulneraqbility in SQLite affects IBM Cloud Application Performance Managment R esponse Time Monitoring Agent (CVE-2020-15358)
2020-09-2202:34:28
www.ibm.com
30
security bulletin
sqlite
ibm cloud application performance management
vulnerability
buffer overflow
cve-2020-15358
ibm tivoli composite application manager for transactions
response time
fix
patch
EPSS
0.002
Percentile
52.4%
Summary
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
Vulnerability Details
CVEID:CVE-2020-15358
**DESCRIPTION:**SQLite is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the mishandling of query-flattener optimization in select.c. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/184103 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Tivoli Composite Application Manager for Transactions (Response Time) | 7.4.0.2 |
| IBM Tivoli Composite Application Manager for Transactions (Response Time) | 7.4.0.1 |
| IBM Cloud Application Performance Management - Response Time Monitoring Agent | 8.1.4 |
Remediation/Fixes
| Product | Product Version | APAR | Remediation / First Fix |
|---|---|---|---|
| IBM Tivoli Composite Application Manager for Transactions (Response Time) | 7.4.0.2 | 7.4.0.2-TIV-CAMRT-IF0014 | |
| http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FTivoli+Composite+Application+Manager+for+Transactions&fixids=7.4.0.2-TIV-CAMRT-IF0014&source=SAR | |||
| IBM Tivoli Composite Application Manager for Transactions (Response Time) | 7.4.0.1 | 7.4.0.1-TIV-CAMRT-IF0048 | |
| http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FTivoli+Composite+Application+Manager+for+Transactions&fixids=7.4.0.1-TIV-CAMRT-IF0048&source=SAR | |||
| IBM Cloud Application Performance Management - Response Time Monitoring Agent | 8.1.4 | If you use the Response Time Monitoring Agent, the vulnerabilities can be remediated by applying the Response Time Monitoring Agent 8.1.4.0-IBM-APM-RT-AGENT-IF00011 patch to all systems where this agent is installed: | |
| http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Application+Performance+Management+Advanced&fixids=8.1.4.0-IBM-APM-RT-AGENT-IF0011&source=SAR |
Workarounds and Mitigations
None
Related
veracode
veracode
Denial Of Service (DoS)
2021-05-20 15:25:52
photon
photon
Home
Download Photon OS
User Documentation
FAQ
Security Advisories
Related Information
Lightwave - PHSA-2020-2.0-0261
2020-07-10 00:00:00
Moderate Photon OS Security Update - PHSA-2020-0113
2020-07-15 00:00:00
Moderate Photon OS Security Update - PHSA-2020-0261
2020-07-10 00:00:00
osv
osv
CVE-2020-15358
2020-06-27 12:15:11
Malicious SQL statement causes an read past the end of a heap buffer
2021-10-01 00:00:00
CGA-363h-f296-cvgc
2024-07-04 22:05:16
debiancve
debiancve
CVE-2020-15358
2020-06-27 12:15:11
openvas
openvas
Ubuntu: Security Advisory (USN-4438-1)
2020-07-28 00:00:00
Huawei EulerOS: Security Advisory for sqlite (EulerOS-SA-2020-1908)
2020-08-31 00:00:00
Huawei EulerOS: Security Advisory for sqlite (EulerOS-SA-2021-1626)
2021-03-12 00:00:00
ibm
ibm
cvelist
cvelist
CVE-2020-15358
2020-06-27 11:39:37
sqlite
sqlite
SQLite report about CVE-2020-15358
2020-01-01 00:00:00
nvd
nvd
CVE-2020-15358
2020-06-27 12:15:11
nessus
nessus
Ubuntu 20.04 LTS : SQLite vulnerability (USN-4438-1)
2020-07-28 00:00:00
Photon OS 2.0: Sqlite PHSA-2020-2.0-0261
2020-07-15 00:00:00
Photon OS 3.0: Sqlite PHSA-2020-3.0-0113
2020-07-15 00:00:00
ubuntucve
ubuntucve
CVE-2020-15358
2020-06-27 00:00:00
ubuntu
ubuntu
SQLite vulnerability
2020-07-27 00:00:00
cbl_mariner
cbl_mariner
CVE-2020-15358 affecting package mysql 8.0.22-2
2021-08-25 19:57:27
redhatcve
redhatcve
CVE-2020-15358
2020-06-29 14:20:54
alpinelinux
alpinelinux
CVE-2020-15358
2020-06-27 12:15:11
prion
prion
Design/Logic Flaw
2020-06-27 12:15:00
cve
cve
CVE-2020-15358
2020-06-27 12:15:11
oraclelinux
oraclelinux
sqlite security update
2021-05-25 00:00:00
rocky
rocky
sqlite security update
2021-05-18 05:34:24
redhat
redhat
(RHSA-2021:1581) Moderate: sqlite security update
2021-05-18 05:34:24
(RHSA-2021:2705) Moderate: Release of OpenShift Serverless 1.16.0
2021-07-13 16:31:04
almalinux
almalinux
Moderate: sqlite security update
2021-05-18 05:34:24
apple
apple
About the security content of iCloud for Windows 7.21 - Apple Support
2020-11-12 10:19:34
About the security content of iCloud for Windows 7.21
2020-09-24 00:00:00
About the security content of tvOS 14.0 - Apple Support
2020-12-15 05:52:05
kaspersky
kaspersky
KLA12006 Multiple vulnerabilities in Apple iCloud
2020-11-12 00:00:00
chrome
chrome
Chrome for Android Update
2020-10-13 00:00:00
mageia
mageia
Updated sqlite3 packages fix security vulnerabilities
2021-07-01 02:58:41
gentoo
gentoo
SQLite: Multiple vulnerabilities
2020-07-27 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1975
2021-07-02 18:09:04
suse
suse
Security update for sqlite3 (important)
2021-07-20 00:00:00
Security update for sqlite3 (important)
2021-07-14 00:00:00
ics
ics
Siemens SINEC INS
2022-03-10 12:00:00
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
2023-12-14 12:00:00
tenable
tenable
[R1] Nessus Network Monitor 6.2.2 Fixes Multiple Vulnerabilities
2023-06-29 10:45:47
oracle
oracle
Oracle Critical Patch Update Advisory - January 2021
2021-01-19 00:00:00
Oracle Critical Patch Update Advisory - April 2021
2021-04-20 00:00:00
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00
EPSS
0.002
Percentile
52.4%
Related for E266F803E71C486543CF623D66DDFA40AA2C4AEB0C15F49A79A5600D3D37709B