CVE-2020-27207

Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c

published November 26, 2020

CVSS
—
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01592 · 75.5th percentile
Published
2020-11-26T16:41Z
EPSS history
Timeline
  • 26 NOV 16:41Z
    Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c
    cvelistv5