In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358
Reference (s):
- https://security.netapp.com/advisory/ntap-20200709-0001/
- URL: https://security.netapp.com/advisory/ntap-20200709-0001/
- https://support.apple.com/kb/HT211843
- URL: https://support.apple.com/kb/HT211843
- https://support.apple.com/kb/HT211844