CVE-2021-42523

Name of the Vulnerable Software and Affected Versions colord (affected versions not specified)

Description The issue is related to two Information Disclosure vulnerabilities in colord. These vulnerabilities are located in colord/src/cd-device-db.c and colord/src/cd-profile-db.c. The problem arises because the err msg of sqlite3 exec is not released after use, contrary to the requirements of libxml2, which states that the caller must release it. This could allow a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.