CVE-2020-11655

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

It seems like this issue existed since sqlite-3.25.0, when window function (https://www.sqlite.org/windowfunctions.html) was added, but it lead to segmentation fault after https://www3.sqlite.org/cgi/src/info/712e47714863a8ed was committed, which could result in denial of service. This commit is a part of sqlite-3.30 release.

Therefore previous versions are not vulnerable to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.