Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade colord | Jul 30, 2024 | Dec 10, 2011 |
| Suse | — | Upgrade libcolord-develUpgrade libcolord-gtk1Upgrade colord-langUpgrade typelib-1_0-Colord-1_0Upgrade colordUpgrade libcolorhug2Upgrade typelib-1_0-ColorHug-1_0Upgrade colord-color-profilesUpgrade typelib-1_0-ColordGtk-1_0Upgrade colord-gtk-langUpgrade libcolord-gtk-develUpgrade libcolord-gtk4-1Upgrade libcolord2-32bitUpgrade libcolord2Upgrade colord-gtkUpgrade colord-gtk-doc | Dec 12, 2013 | Jul 9, 2013 |
| Ubuntu | — | Upgrade colord | Nov 8, 2024 | Dec 10, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub