Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade colord | Jul 30, 2024 | Dec 10, 2011 |
| Suse | — | Upgrade typelib-1_0-Colorhug-1_0Upgrade libcolorhug2Upgrade colord-langUpgrade libcolord-develUpgrade typelib-1_0-Colord-1_0Upgrade libcolord-gtk1Upgrade colordUpgrade colord-color-profilesUpgrade typelib-1_0-ColordGtk-1_0Upgrade colord-gtkUpgrade libcolord-gtk-develUpgrade colord-gtk-docUpgrade libcolord2Upgrade libcolord-gtk4-1Upgrade libcolord2-32bitUpgrade colord-gtk-lang | Dec 12, 2013 | Jul 9, 2013 |
| Ubuntu | — | Upgrade colord | Nov 8, 2024 | Dec 10, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub