« Volver al listado

CVE-2021-42523

Estado: ModificadaAlta (7.5)—

Se presentan dos vulnerabilidades de divulgación de información en colord, y son encontradas en los archivos colord/src/cd-device-db.c y colord/src/cd-profile-db.c por separado. Se presentan porque el "err_msg" de "sqlite3_exec" no es liberado después de su uso, mientras que libxml2 enfatiza que el llamador debe liberarlo.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Colord Project — Colord

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-42523",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "colord",
          "versions": [
            {
              "status": "affected",
              "version": "colord - 1.4.4, 1.4.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-25T18:15:09.260",
  "references": [
    {
      "url": "https://github.com/hughsie/colord/issues/110",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://github.com/hughsie/colord/issues/110",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "patrick@puiterwijk.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it."
    },
    {
      "lang": "es",
      "value": "Se presentan dos vulnerabilidades de divulgación de información en colord, y son encontradas en los archivos colord/src/cd-device-db.c y colord/src/cd-profile-db.c por separado. Se presentan porque el \"err_msg\" de \"sqlite3_exec\" no es liberado después de su uso, mientras que libxml2 enfatiza que el llamador debe liberarlo."
    }
  ],
  "lastModified": "2026-06-17T04:09:45.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:colord_project:colord:1.4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E226351-6F3B-47C1-9E4A-72398A194CA5"
            },
            {
              "criteria": "cpe:2.3:a:colord_project:colord:1.4.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F0E84AE-F68D-4AE7-B284-3D0A1B1BF175"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}