CVE-2020-27207

Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.

• CWE-416

• https://github.com/sqlcipher/sqlcipher/compare/v4.4.0...v4.4.1Third Party Advisory
• https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842Third Party Advisory
• https://www.telekom.com/resource/blob/612796/9f221708832a465f03585a45d7f59b45/dl-201112-denial-of-serviceen-data.pdfThird Party Advisory
• https://github.com/sqlcipher/sqlcipher/compare/v4.4.0...v4.4.1Third Party Advisory
• https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842Third Party Advisory
• https://www.telekom.com/resource/blob/612796/9f221708832a465f03585a45d7f59b45/dl-201112-denial-of-serviceen-data.pdfThird Party Advisory

Published

Nov 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27194An issue was discovered in the Linux kernel before 5.8.15. s…5.5
• CVE-2020-27195HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.1…9.1
• CVE-2020-27196An issue was discovered in PlayJava in Play Framework 2.6.0 …7.5
• CVE-2020-27197TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTA…9.8
• CVE-2020-27199The Magic Home Pro application 1.5.1 for Android allows Auth…7.5
• CVE-2020-2720Vulnerability in the Oracle FLEXCUBE Investor Servicing prod…5.4
• CVE-2020-27208The flash read-out protection (RDP) level is not enforced du…6.8
• CVE-2020-27209The ECDSA operation of the micro-ecc library 1.0 is vulnerab…7.5
• CVE-2020-2721Vulnerability in the Oracle FLEXCUBE Investor Servicing prod…6.5
• CVE-2020-27211Nordic Semiconductor nRF52840 devices through 2020-10-19 hav…5.7
• CVE-2020-27212STMicroelectronics STM32L4 devices through 2020-10-19 have i…7
• CVE-2020-27213An issue was discovered in Ethernut Nut/OS 5.1. The code tha…7.5