CVE-2020-13434: 
SQLite vulnerability analysis and mitigation

SQLite through version 3.32.0 contains an integer overflow vulnerability in the sqlite3_str_vappendf function in printf.c. The vulnerability was discovered on May 23, 2020 and affects all versions of SQLite since printf() was introduced in version 3.8.3 (2014-02-03) (SQLite Ticket, SQLite Fix).

The vulnerability occurs due to an integer overflow in the precision handling of floating-point to text conversions in the printf() function. This can be triggered by providing a large precision value, such as in the SQL statement 'SELECT printf('%.*g',2147483647,0.01);'. The issue was fixed by implementing a hard limit (SQLITE_FP_PRECISION_LIMIT) of 100,000,000 on the precision of floating-point conversions (SQLite Fix).

When successfully exploited, this vulnerability could lead to a stack overflow condition, potentially resulting in denial of service (DoS) or arbitrary code execution. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

The vulnerability can be exploited remotely without requiring authentication. A proof of concept exploit exists that demonstrates the vulnerability using SQL statements involving the printf function with maliciously crafted precision values (SQLite Ticket).

The vulnerability was fixed in SQLite version 3.32.1 by implementing a hard limit on floating-point precision. Users should upgrade to this version or later. Multiple vendors have released patches for their products incorporating this fix, including Apple, Oracle, Red Hat, and others (FreeBSD Advisory, Debian Advisory).