CVEs-PoC/2020/CVE-2020-27207.md

### [CVE-2020-27207](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27207)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.

### POC

#### Reference
- https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842

#### Github
No PoCs found on GitHub currently.