| Package | Affected versions | Patched versions |
|---|---|---|
| sqlcipher | ≥ 4.0, < 4.4.1 | 4.4.1 |
Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free