What’s Vulnerable › Vulnerabilities

CVE-2020-9327

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-21 · updated 2026-10-14
• Weakness: CWE-476

Description

In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 19.10
• NetApp Cloud Backup: all versions
• Oracle Communications Messaging Server: 8.1
• Oracle Communications Network Charging And Control: from 12.0.0 through 12.0.3; 6.0.1, 12.0.2
• Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
• Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
• Oracle Corporation MySQL Workbench: through 8.0.22
• Oracle Corporation Outside In Technology: 8.5.4, 8.5.5
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
• SQLite: 3.31.1

How to fix

Upgrade to a fixed version: Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://security.gentoo.org/glsa/202003-16
• https://security.netapp.com/advisory/ntap-20200313-0002/
• https://usn.ubuntu.com/4298-1/
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.sqlite.org/cgi/src/info/4374860b29383380
• https://www.sqlite.org/cgi/src/info/9d0d4ab95dc0c56e
• https://www.sqlite.org/cgi/src/info/abc473fb8fb99900
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Get alerted when CVE-2020-9327 or the next vulnerability affects your stack