CVE catalog

CVE-2021-3119

sqlcipher: CVE-2021-3119

Severity: Low
Source: [NVD] · [CVE record]
EPSS: 1.56% · Oct 25, 2026

Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	sqlcipher	sid	`4.19.0-1`	not affected
Debian	sqlcipher	forky	`4.19.0-1`	not affected
Debian	sqlcipher	trixie	`4.6.1-2`	not affected
Debian	sqlcipher	bookworm	`3.4.1-2`	not affected

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	sqlcipher	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	sqlcipher	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	sqlcipher	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	sqlcipher	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libsqlcipher0]Not affected
Source package: [sqlcipher]
Details (2)
- 3.4.1-2+b1 · amd64 · bookworm
  Not affected
  dsa · sqlcipher · debian · bookworm
- 3.4.1-2+b1 · arm64 · bookworm
  Not affected
  dsa · sqlcipher · debian · bookworm
[libsqlcipher1]Not affected
Source package: [sqlcipher]
Details (2)
- 4.6.1-2~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · sqlcipher · debian · bookworm
- 4.6.1-2~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · sqlcipher · debian · bookworm
[libsqlcipher-dev]Not affected
Source package: [sqlcipher]
Details (4)
- 3.4.1-2+b1 · amd64 · bookworm
  Not affected
  dsa · sqlcipher · debian · bookworm
- 3.4.1-2+b1 · arm64 · bookworm
  Not affected
  dsa · sqlcipher · debian · bookworm
- 4.6.1-2~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · sqlcipher · debian · bookworm
- 4.6.1-2~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · sqlcipher · debian · bookworm
[sqlcipher]Not affected
Details (4)
- 3.4.1-2+b1 · amd64 · bookworm
  Not affected
  dsa · sqlcipher · debian · bookworm
- 3.4.1-2+b1 · arm64 · bookworm
  Not affected
  dsa · sqlcipher · debian · bookworm
- 4.6.1-2~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · sqlcipher · debian · bookworm
- 4.6.1-2~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · sqlcipher · debian · bookworm

Observed: Oct 23, 2026, 5:56:51 PM UTC

References

[https://security-tracker.debian.org/tracker/CVE-2021-3119]

[Debian Security Tracker] · [FIRST EPSS]