CVE-2021-42523

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.
References
Link Resource
https://github.com/hughsie/colord/issues/110 Exploit Issue Tracking Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:colord_project:colord:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:colord_project:colord:1.4.5:*:*:*:*:*:*:*

History

17 Jul 2023, 15:18

Type Values Removed Values Added
CWE CWE-200 CWE-401

Information

Published : 2022-08-25 18:15

Updated : 2024-02-28 19:29


NVD link : CVE-2021-42523

Mitre link : CVE-2021-42523

CVE.ORG link : CVE-2021-42523


JSON object : View

Products Affected

colord_project

  • colord
CWE
CWE-401

Missing Release of Memory after Effective Lifetime

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor