CVE-2020-13871: Debian Linux

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Oracle Communications Messaging Server: version 8.1 only
• Oracle Communications Network Charging And Control: version 6.0.1 only; version 12.0.2 only
• Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
• Oracle Hyperion Infrastructure Technology: version 11.1.2.4 only
• Oracle MySQL Workbench: up to and including 8.0.22
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
• Sqlite Sqlite: version 3.32.2 only

Published 2020-06-06. Last modified 2026-06-17.