Lucene search

Gentoo FoundationMGASA-2022-0366

HistoryOct 08, 2022 - 11:22 p.m.

Updated colord packages fix security vulnerability

2022-10-0823:22:22

Gentoo Foundation

advisories.mageia.org

colord

security vulnerabilities

cd-device-db.c

cd-profile-db.c

information disclosure

cve-2021-42523

libxml2

unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

58.7%

JSON

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the ‘err_msg’ of ‘sqlite3_exec’ is not releasing after use, while libxml2 emphasizes that the caller needs to release it. (CVE-2021-42523)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchcolord< 1.4.5-1.1colord-1.4.5-1.1.mga8

OS	Version	Architecture	Package	Version	Filename
Mageia	8	noarch	colord	< 1.4.5-1.1	colord-1.4.5-1.1.mga8

References

bugs.mageia.org/show_bug.cgi?id=30944

lists.opensuse.org/archives/list/[email protected]/thread/2GDIFQ2MG4MYMILUVYH7MTM5YKO2AMDS/

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

58.7%

JSON

Related for MGASA-2022-0366