CVE-2021-42523
25.08.2022, 18:15
There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| colord_project | colord | 1.4.4 |
| colord_project | colord | 1.4.5 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| colord |
| ||||||||||||||||||||||||||||||||||||||||||||||
| colord-color-profiles |
| ||||||||||||||||||||||||||||||||||||||||||||||
| colord-lang |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libcolord-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libcolord2 |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libcolord2-32bit |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libcolorhug2 |
| ||||||||||||||||||||||||||||||||||||||||||||||
| typelib-1_0-Colord-1_0 |
| ||||||||||||||||||||||||||||||||||||||||||||||
| typelib-1_0-Colorhug-1_0 |
|
Common Weakness Enumeration
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-401 - Missing Release of Memory after Effective LifetimeThe software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.