Skip to content
Fencer Vulns
high 7.5

CVE-2021-42523 json

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c se…

published 2022-08-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-29492

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.

Patch / fix

  • colord Debian 14, Debian 13, Debian 12 1.4.6-1

debian advisories DEBIAN-CVE-2021-42523

  • colord SLE Workstation Extension 15 SP7, SLE Workstation Extension 15 SP6, SLE Module for Package Hub 15 SP7 +6 more 1.4.6-150600.3.8.1
  • colord Linux Micro 6.0 1.4.6-4.1
  • colord SLE Micro 5.5, SLE Micro 5.4, SLE Micro 5.3 1.4.5-150400.4.9.1
  • colord Linux Micro 6.1 1.4.6-slfo.1.1_2.1
  • colord SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +1 more 1.3.3-13.3.1
  • colord SLE Workstation Extension 15 SP3, SLE Module for Desktop Applications 15 SP3, SLE Module for Basesystem 15 SP3 +3 more 1.4.4-150200.4.6.1
  • colord SLE Workstation Extension 15 SP4, SLE Module for Desktop Applications 15 SP4, SLE Module for Basesystem 15 SP4 +2 more 1.4.5-150400.4.3.1
  • colord SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.3.3-13.9.2

suse advisories SUSE-SU-2025:4483-1SUSE-SU-2025:3949-1SUSE-SU-2025:20935-1SUSE-SU-2025:3899-1SUSE-SU-2025:20964-1SUSE-SU-2022:4410-1

  • colord openSUSE Tumbleweed 1.4.6-2.1

opensuse advisories openSUSE-SU-2024:12353-1

  • colord CBL-Mariner 2.0 1.4.4-9

azure linux advisories AZL-10716

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-42523 updated cvss 7.5

colord: potential memory leak, forgetting to free error message of libsqlite3 API 'sqlite3_exec' -1

  • Red Hat OpenShift Developer Tools and Services odo Red Hat Enterprise Linux 7 colord, colord-libs, compat-libcolord1, colord-extra-profiles Red Hat Enterprise Linux 8 colord, colord-libs Red Hat Enterprise Linux 9 colord, colord-libs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/hughsie/colord/issues/110 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • n/a colord

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.