CVE-2020-13434

Name	CVE-2020-13434
Description	SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2221-1, DLA-2340-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sqlite (PTS)	jessie, jessie (lts)	2.8.17-12+deb8u1	fixed
	stretch (lts), stretch	2.8.17-14+deb9u1	fixed
	buster (security), buster, buster (lts)	2.8.17-15+deb10u1	fixed
sqlite3 (PTS)	jessie, jessie (lts)	3.8.7.1-1+deb8u8	fixed
	stretch (security)	3.16.2-5+deb9u3	fixed
	stretch (lts), stretch	3.16.2-5+deb9u4	fixed
	buster, buster (lts)	3.27.2-3+deb10u3	fixed
	buster (security)	3.27.2-3+deb10u2	fixed
	bullseye	3.34.1-3	fixed
	bullseye (security)	3.34.1-3+deb11u1	fixed
	bookworm	3.40.1-2+deb12u1	fixed
	sid, trixie	3.46.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
sqlite	source	jessie	(not affected)
sqlite	source	stretch	(not affected)
sqlite	source	buster	(not affected)
sqlite	source	(unstable)	(unfixed)
sqlite3	source	wheezy	(unfixed)	end-of-life
sqlite3	source	jessie	3.8.7.1-1+deb8u6		DLA-2221-1
sqlite3	source	stretch	3.16.2-5+deb9u2		DLA-2340-1
sqlite3	source	buster	3.27.2-3+deb10u1
sqlite3	source	(unstable)	3.32.1-1

Notes

[buster] - sqlite <not-affected> (Vulnerable code introduced later)
https://www.sqlite.org/src/info/23439ea582241138
https://www.sqlite.org/src/info/d08d3405878d394e
https://github.com/sqlite/sqlite/commit/dd6c33d372f3b83f4fe57904c2bd5ebba5c38018
floating point precision limit safeguards are present in sqlite (V2), refactoring in V3 made it vulnerable.
[stretch] - sqlite <not-affected> (Vulnerable code introduced later)
[jessie] - sqlite <not-affected> (Vulnerable code introduced later)