{"id":"CVE-2021-42523","aliases":["AZL-10716","CLSA-2026-1776761965","DEBIAN-CVE-2021-42523","EUVD-2021-29492","GHSA-r93j-wmmw-g27p","MGASA-2022-0366","OESA-2022-1914","SUSE-SU-2022:3496-1","SUSE-SU-2022:4170-1","SUSE-SU-2022:4410-1","SUSE-SU-2025:20935-1","SUSE-SU-2025:20964-1","SUSE-SU-2025:3899-1","SUSE-SU-2025:3949-1","SUSE-SU-2025:4483-1","UBUNTU-CVE-2021-42523","openSUSE-SU-2024:12353-1"],"status":"published","title":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd...","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0099,"percentile":0.62948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-401"],"published":"2022-08-25T17:27:21Z","modified":"2026-10-23T18:04:16Z","fixes":[{"ecosystem":"Azure Linux:2","package":"colord","fixed_in":["1.4.4-9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord","fixed_in":["1.4.5-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-devel","fixed_in":["1.4.5-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-devel-docs","fixed_in":["1.4.5-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-extra-profiles","fixed_in":["1.4.5-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-libs","fixed_in":["1.4.5-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-tests","fixed_in":["1.4.5-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"colord","fixed_in":["1.4.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"colord","fixed_in":["1.4.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"colord","fixed_in":["1.4.6-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"colord","fixed_in":["1.4.5-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"colord","fixed_in":["1.4.4-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"colord","fixed_in":["1.4.4-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"colord","fixed_in":["1.4.5-4.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"colord","fixed_in":["1.4.5-150400.4.3.1","1.4.5-150400.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"colord","fixed_in":["1.4.5-150400.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"colord","fixed_in":["1.4.5-150400.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"colord","fixed_in":["1.4.5-150400.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"colord","fixed_in":["1.4.5-150400.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"colord","fixed_in":["1.4.4-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"colord","fixed_in":["1.4.4-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"colord","fixed_in":["1.4.4-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"colord","fixed_in":["1.4.4-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"colord","fixed_in":["1.4.4-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"colord","fixed_in":["1.4.4-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"colord","fixed_in":["1.3.3-13.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"colord","fixed_in":["1.3.3-13.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"colord","fixed_in":["1.3.3-13.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"colord","fixed_in":["1.3.3-13.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"colord","fixed_in":["1.4.6-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"colord","fixed_in":["1.4.6-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"colord","fixed_in":["1.4.5-150400.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"colord","fixed_in":["1.4.5-150400.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"colord","fixed_in":["1.4.6-150600.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"colord","fixed_in":["1.3.3-13.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"colord","fixed_in":["1.3.3-13.9.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"colord","fixed_in":["1.4.6-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-extra-profiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"colord-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-4.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-13.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-13.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-13.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-13.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150400.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-150600.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-13.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-13.9.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"colord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2.1"}]}]}],"products":[{"vendor":"colord_project","product":"colord"},{"vendor":"microsoft","product":"colord"}],"references":[{"url":"https://github.com/hughsie/colord/issues/110","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42523","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r93j-wmmw-g27p"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1776761965.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-42523","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0366.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30944","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2GDIFQ2MG4MYMILUVYH7MTM5YKO2AMDS/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1914","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223496-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202802","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42523","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224170-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224410-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520935-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250750","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520964-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253899-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253949-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254483-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-42523","tags":["report"]},{"url":"https://github.com/hughsie/colord/commit/adf41f36cf7214d7d6fa8d528b74eba47c377405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42523","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-42523","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"published","published":"2022-08-25T17:27:21Z","modified":"2024-08-04T03:30:38.667Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:58.739039Z"}],"euvd":[{"id":"EUVD-2021-29492","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"published","published":"2022-08-25T17:27:21Z","modified":"2024-08-04T03:30:38Z","updated_at":"2026-11-03T03:24:15.755984Z"}],"ghsa":[{"id":"GHSA-r93j-wmmw-g27p","title":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd...","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"published","published":"2022-08-26T00:03:31Z","modified":"2023-07-17T15:30:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-401"],"updated_at":"2026-11-02T14:54:42.596364Z"}],"nvd":[{"id":"CVE-2021-42523","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"published","published":"2022-08-25T18:15:09.26Z","modified":"2026-06-17T04:09:45.7Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200","CWE-401"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"AZL-10716","title":"CVE-2021-42523 affecting package colord for versions less than 1.4.4-9","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"published","published":"2022-08-25T18:15:09Z","modified":"2026-04-21T04:21:24.136579Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"CVE-2021-42523","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"published","published":"2022-08-25T18:15:09.26Z","modified":"2026-10-20T10:55:01.12877108Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-42523","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"published","published":"2022-08-25T18:15:09.26Z","modified":"2026-10-23T18:04:16.069141928Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"OESA-2022-1914","title":"colord security update","description":"colord is a system service that makes it easy to manage, install and generate color profiles to accurately color manage input and output devices.\r\n\r\nSecurity Fix(es):\r\n\r\nThere are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the \u0026apos;err_msg\u0026apos; of \u0026apos;sqlite3_exec\u0026apos; is not releasing after use, while libxml2 emphasizes that the caller needs to release it.(CVE-2021-42523)","status":"published","published":"2022-09-16T11:05:13Z","modified":"2026-08-18T01:17:17.122920469Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-42523","description":"There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.","status":"withdrawn","published":"2022-08-25T18:15:00Z","modified":"2025-07-16T07:43:22.033572Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"CLSA-2026-1776761965","title":"colord: Fix of CVE-2021-42523","description":"- CVE-2021-42523: fix memory leak in cd_device_db_load() and cd_profile_db_load()\n  where sqlite3_exec() error_msg output was allocated but never freed","status":"published","published":"2026-04-21T08:59:29Z","modified":"2026-06-01T00:32:23.53142271Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"MGASA-2022-0366","title":"Updated colord packages fix security vulnerability","description":"There are two Information Disclosure vulnerabilities in colord, and they\nlie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c\nseparately. They exist because the 'err_msg' of 'sqlite3_exec' is not\nreleasing after use, while libxml2 emphasizes that the caller needs to\nrelease it. (CVE-2021-42523)\n","status":"published","published":"2022-10-08T20:22:22Z","modified":"2026-04-16T04:44:14.860784706Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12353-1","title":"colord-1.4.6-2.1 on GA media","description":"These are all security issues fixed in the colord-1.4.6-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:51.558963Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3496-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n\n- CVE-2021-42523: Fixed a small memory leak in sqlite3_exec (bsc#1202802).\n","status":"published","published":"2022-10-04T07:47:43Z","modified":"2026-02-04T04:05:27.695017Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4170-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n  \n- CVE-2021-42523: Fixed small memory leak in sqlite3_exec (bsc#1202802).\n","status":"published","published":"2022-11-22T13:18:47Z","modified":"2026-02-04T02:46:43.931556Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4410-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n\n- CVE-2021-42523: Fixed a small memory leak in sqlite3_exec (bsc#1202802).\n","status":"published","published":"2022-12-12T09:27:01Z","modified":"2026-02-04T03:19:46.482795Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2025:20935-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n\n- CVE-2021-42523: Fixed information disclosure in cd-device-db.c\n  and cd-profile-db.c (bsc#1250750).\n","status":"published","published":"2025-10-31T16:29:21Z","modified":"2026-03-23T04:49:10.499501Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20964-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n\n- CVE-2021-42523: Fixed information disclosure in cd-device-db.c\n  and cd-profile-db.c (bsc#1250750).\n","status":"published","published":"2025-10-30T12:29:30Z","modified":"2026-03-23T04:49:12.016536Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:3899-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n\n- CVE-2021-42523: The original fix was wrong and did not properly free the error, resulting in a crash that has now been addressed (bsc#1250750).\n","status":"published","published":"2025-10-31T14:56:12Z","modified":"2025-10-31T22:02:13.329414Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3949-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n\n- CVE-2021-42523: The original fix was wrong and did not properly free the error, resulting in a crash that has now been addressed (bsc#1250750).\n","status":"published","published":"2025-11-05T10:04:38Z","modified":"2026-03-23T04:51:21.708458Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4483-1","title":"Security update for colord","description":"This update for colord fixes the following issues:\n\n- Rework fix for CVE-2021-42523 to avoid invalid pointer error during certain installations (bsc#1250750).\n","status":"published","published":"2025-12-18T12:29:27Z","modified":"2026-03-23T04:45:50.609136Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}