CVE-2020-13630

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.32.0

Description The issue is related to a use-after-free in the fts3EvalNextRow function of the ext/fts3/fts3.c component in SQLite, which can lead to memory corruption and potentially allow an attacker to execute arbitrary code. This is also associated with an integer overflow. A remote attacker may exploit this to cause arbitrary code execution.

Recommendations For versions prior to 3.32.0, update to version 3.32.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the fts3EvalNextRow function until a patch is applied. Avoid using the snippet feature in the affected ext/fts3/fts3.c component until the issue is resolved.