CVE-2021-42523

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.

colord is a system service that makes it easy to manage, install and generate color profiles to accurately color manage input and output devices.

Security Fix(es):

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.(CVE-2021-42523)

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.

• CVE-2021-42523: fix memory leak in cd_device_db_load() and cd_profile_db_load() where sqlite3_exec() error_msg output was allocated but never freed

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it. (CVE-2021-42523)

These are all security issues fixed in the colord-1.4.6-2.1 package on the GA media of openSUSE Tumbleweed.

This update for colord fixes the following issues:

• CVE-2021-42523: Fixed a small memory leak in sqlite3_exec (bsc#1202802).

This update for colord fixes the following issues:

• CVE-2021-42523: Fixed small memory leak in sqlite3_exec (bsc#1202802).

This update for colord fixes the following issues:

• CVE-2021-42523: Fixed a small memory leak in sqlite3_exec (bsc#1202802).

This update for colord fixes the following issues:

• CVE-2021-42523: Fixed information disclosure in cd-device-db.c and cd-profile-db.c (bsc#1250750).

This update for colord fixes the following issues:

• CVE-2021-42523: Fixed information disclosure in cd-device-db.c and cd-profile-db.c (bsc#1250750).

This update for colord fixes the following issues:

• CVE-2021-42523: The original fix was wrong and did not properly free the error, resulting in a crash that has now been addressed (bsc#1250750).

This update for colord fixes the following issues:

• CVE-2021-42523: The original fix was wrong and did not properly free the error, resulting in a crash that has now been addressed (bsc#1250750).

This update for colord fixes the following issues:

• Rework fix for CVE-2021-42523 to avoid invalid pointer error during certain installations (bsc#1250750).