# SQLCipher binaries memory corruption vulnerabilities

**URL:** <https://discuss.zetetic.net/t/sqlcipher-binaries-memory-corruption-vulnerabilities/5989>\
**Category:** SQLCipher\
**Created:** [June 26, 2023, 5:07am UTC](https://discuss.zetetic.net/t/sqlcipher-binaries-memory-corruption-vulnerabilities/5989 "2023-06-26T05:07:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chetan](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@chetan](https://discuss.zetetic.net/u/chetan)\
**Post date:** [June 26, 2023, 5:07am UTC](https://discuss.zetetic.net/t/sqlcipher-binaries-memory-corruption-vulnerabilities/5989/1 "2023-06-26T05:07:31Z")

</div>

In our Android application, we implemented the SQLCipher library with version “net.zetetic:android-database-sqlcipher:4.4.2”. However, during the VAPT testing, we discovered the following issue. Could you please provide some possible solutions for this problem?

Description:  
It was found that a number of binaries embedded into the Android application are currently not leveraging the available compiler flags to mitigate potential memory corruption vulnerabilities. This unnecessarily puts the application more at risk for such issues. Binaries missing usage of -D\_FORTIFY\_SOURCE=2 Missing this flag means common libc functions are missing buffer overflow checks, so  
the application is more prone to memory corruption vulnerabilities. Please note that most binaries are affected, the following is a reduced list of examples for the sake of brevity.

Binaries (from decompiled production app):  
lib/armeabi-v7a/libsqlcipher.so  
lib/x86\_64/libsqlcipher.so  
lib/x86/libsqlcipher.so  
lib/arm64-v8a/libsqlcipher.so

We would greatly appreciate your assistance.

---

<div class="post-metadata">

**Author:** ![developernotes](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/developernotes/32/1309_2.png) [@developernotes](https://discuss.zetetic.net/u/developernotes)\
**Post date:** [June 27, 2023, 2:03pm UTC](https://discuss.zetetic.net/t/sqlcipher-binaries-memory-corruption-vulnerabilities/5989/2 "2023-06-27T14:03:27Z")

</div>

Hello @chetan,

`D_FORTIFY_SOURCE` is used on all native builds with the latest release of SQLCipher for Android. We would recommend updating to the latest, currently 4.5.4.

---

<div class="post-metadata">

**Author:** ![chetan](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@chetan](https://discuss.zetetic.net/u/chetan)\
**Post date:** [June 28, 2023, 5:04am UTC](https://discuss.zetetic.net/t/sqlcipher-binaries-memory-corruption-vulnerabilities/5989/3 "2023-06-28T05:04:53Z")

</div>

Hi @developernotes,  
Thanks for your prompt response, we will update the latest library and check.