sqlcipher / android-database-sqlcipher

Android SQLite API based on SQLCipher
https://www.zetetic.net/sqlcipher/sqlcipher-for-android/
Other
2.73k stars 564 forks source link

Vulnerability in SQLite3.39.2 BDSA-2023-3627 #642

Closed sankar-gp closed 3 months ago

sankar-gp commented 3 months ago

Our internal tool reported that there is a Vulnerability in SQLite3.39.2

BDSA-2023-3627

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

sjlombardo commented 3 months ago

dupe of https://github.com/sqlcipher/android-database-sqlcipher/issues/641