PT-2011-4939 · None · Colord

Publicado 2011-12-10 · Atualizado 2024-06-15 · CVE-2011-4349

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions colord versions prior to 0.1.15

Description The issue concerns SQL injection vulnerabilities in the colord software. These vulnerabilities are located in the cd-mapping-db.c and cd-device-db.c files. They allow local users to execute arbitrary SQL commands through various vectors, including those related to color devices, device id, property, or profile id.

Recommendations For versions prior to 0.1.15, update to version 0.1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL database to minimize the risk of exploitation. Avoid using the device id, property, or profile id variables in SQL queries until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2011-4349

OPENSUSE-SU-2024:10103-1

Produtos afetados

Colord

Referências · 18

• http://gitorious.org/colord/master/commit/1fadd90afcb4bbc47513466ee9bb1e4a8632ac3b · Nota
• http://openwall.com/lists/oss-security/2011/11/25/3 · Nota
• https://suse.com/security/cve/CVE-2011-4349 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-4349 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=757171 · Nota
• https://bugs.freedesktop.org/show_bug.cgi?id=42904 · Correção
• http://ubuntu.com/usn/usn-1289-1 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070518.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4349 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070450.html · Aviso do Fabricante
• http://secunia.com/advisories/47160 · Aviso do Fabricante
• http://secunia.com/advisories/46940 · Aviso do Fabricante
• http://gitorious.org/colord/master/commit/36549e0ed255e7dfa7852d08a75dd5f00cbd270e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4349 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:10103-1 · Aviso do Fabricante