CVE-2020-15358: apple icloud Out-of-bounds Write
CVSS: 5.5v3.1MediumModified
AliasesALPINE-CVE-2020-15358UBUNTU-CVE-2020-15358USN-4438-1DEBIAN-CVE-2020-15358CGA-2vhg-vq2r-jjfxCGA-4g82-j3p7-wrr8CGA-6f83-ghm7-rmcpCGA-6hqx-x7fg-gff5CGA-6wm5-jm5g-p2f3CGA-78rw-mp8h-qh27CGA-86vp-4r5h-3gphCGA-8r7m-5jcm-p533CGA-8vm3-fp9h-4f23CGA-9946-gc86-834mCGA-jpf3-827f-mqjvCGA-ww93-6f6c-xrh6
Published 27-06-2020Last modified 14-10-2026
Vulnerability summary
CVE-2020-15358 is a medium (CVSS 5.5) Out-of-bounds Write vulnerability in apple icloud. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
1.02%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 27-06-2020PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.02%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
-0.01 pp
From 1.03% on 18-09-2026
18-09-202618-10-2026
EPSS score1.02%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (sqlite.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Oracle7 products
- communications_cloud_native_core_policy1.14.0
- communications_messaging_server8.1
- communications_network_charging_and_control6.0.1 | 12.0.2
- enterprise_manager_ops_center12.4.0.0
- hyperion_infrastructure_technology11.1.2.4
Chainguard6 products
- mysql-8.0< 8.0.38-r0
- mysql-8.0-client< 8.0.38-r0
- mysql-8.0-dev< 8.0.38-r0
- mysql-8.0-iamguarded-compat< 8.0.38-r0
- mysql-8.0-oci-entrypoint< 8.0.38-r0
Alpine1 product
- sqlite< 3.32.1-r1
Canonical1 product
- ubuntu_linuxEOL20.04
Debian1 product
- sqlite3< 3.32.3-1
Siemens1 product
Sqlite1 product
- sqlite< 3.32.3
Ubuntu1 product
- sqlite3< 3.31.1-4ubuntu0.2
9 vendors · 25 products
References
30 links- www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2X Refsource MISCREPORTFIXPatchVendor Advisory
Show all 30 references
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfX Refsource CONFIRMAdvisoryThird Party Advisory
