CVE-2020-13434: apple icloud Integer Overflow or Wraparound

Modified

AliasesALPINE-CVE-2020-13434UBUNTU-CVE-2020-13434DEBIAN-CVE-2020-13434+1 more

Published 24-05-2020Last modified 14-10-2026

Vulnerability summary

CVE-2020-13434 is a medium (CVSS 5.5) Integer Overflow or Wraparound vulnerability in apple icloud. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 63% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

1.00%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 10 · Related 6

DLA-2340-1 MGASA-2021-0303 OPENSUSE-SU-2021:1058-1 OPENSUSE-SU-2021:2320-1 OPENSUSE-SU-2024:11400-1 RHSA-2021:1581+4 more

Timeline

24-05-2020
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.15.5v2.02.1

EPSS trend

Probability

1.00%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 1.01% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (sqlite.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Apple7 products

icloud< 11.5
ipados< 14.0
iphone_os< 14.0
itunes< 12.10.9
macos≥ 11.0, < 11.0.1

Show all 7

Oracle3 products

communications_cloud_native_core_policy1.14.0
communications_network_charging_and_control≥ 12.0.0, ≤ 12.0.3 | 6.0.1
outside_in_technology8.5.5

Debian2 products

sqlite3< 3.8.7.1-1+deb8u6 | < 3.32.1-1
debian_linuxEOL8.0 | 9.0

Alpine1 product

sqlite< 3.32.1-r0

Canonical1 product

ubuntu_linuxEOL16.04 | 18.04 | 19.10 | 20.04

Fedoraproject1 product

fedoraEOL32

Freebsd1 product

freebsdEOL≥ 11.0, < 11.4 | 11.4 | 11.4:p1 | 12.0 | 12.0:p1 | 12.0:p10 | 12.0:p11 | 12.0:p12 | 12.0:p2 | 12.0:p3 | 12.0:p4 | 12.0:p5 | 12.0:p6 | 12.0:p7 | 12.0:p8 | 12.0:p9 | 12.1 | 12.1:p1 | 12.1:p2 | 12.1:p3 | 12.1:p4 | 12.1:p5 | 12.1:p6 | 12.1:p7

Sqlite1 product

sqlite≤ 3.32.0

Ubuntu1 product

sqlite3< 3.11.0-1ubuntu1.5 | < 3.22.0-1ubuntu0.4 | < 3.31.1-4ubuntu0.1

9 vendors · 18 products

References

29 links

lists.debian.org/debian-lts-announce/2020/05/msg00024.htmlMailing ListX Refsource MLISTREPORTThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
usn.ubuntu.com/4394-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISCPatchThird Party Advisory
www.sqlite.org/src/info/23439ea582241138X Refsource MISCExploitPatchVendor Advisory
www.sqlite.org/src/info/d08d3405878d394eX Refsource MISCPatchVendor Advisory
security.netapp.com/advisory/ntap-20200528-0004/X Refsource CONFIRMThird Party Advisory
security.gentoo.org/glsa/202007-26Vendor AdvisoryX Refsource GENTOOThird Party Advisory
security.freebsd.org/advisories/FreeBSD-SA-20:22.sqlite.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
lists.debian.org/debian-lts-announce/2020/08/msg00037.htmlMailing ListX Refsource MLISTThird Party Advisory

Show all 29 references

seclists.org/fulldisclosure/2020/Nov/19Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2020/Nov/20Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2020/Nov/22Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2020/Dec/32Mailing ListX Refsource FULLDISCThird Party Advisory
support.apple.com/kb/HT211843X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT211850X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT211844X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT211931X Refsource CONFIRMThird Party Advisory
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCPatchThird Party Advisory
support.apple.com/kb/HT211952X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT211935X Refsource CONFIRMThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCPatchThird Party Advisory
security.alpinelinux.org/vuln/CVE-2020-13434Advisory
ubuntu.com/security/CVE-2020-13434REPORT
ubuntu.com/security/notices/USN-4394-1Advisory
www.cve.org/CVERecord?id=CVE-2020-13434REPORT
security-tracker.debian.org/tracker/CVE-2020-13434Advisory
nvd.nist.gov/vuln/detail/CVE-2020-13434OvalAdvisory
cert-portal.siemens.com/productcert/html/ssa-398330.html