PT-2011-4939 · None · Colord

Published 2011-12-10 · Updated 2024-06-15 · CVE-2011-4349

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions colord versions prior to 0.1.15

Description The issue concerns SQL injection vulnerabilities in the colord software. These vulnerabilities are located in the cd-mapping-db.c and cd-device-db.c files. They allow local users to execute arbitrary SQL commands through various vectors, including those related to color devices, device id, property, or profile id.

Recommendations For versions prior to 0.1.15, update to version 0.1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL database to minimize the risk of exploitation. Avoid using the device id, property, or profile id variables in SQL queries until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-4349

OPENSUSE-SU-2024:10103-1

Affected Products

Colord

References · 18

• https://security-tracker.debian.org/tracker/CVE-2011-4349 · Vendor Advisory
• https://bugs.freedesktop.org/show_bug.cgi?id=42904 · Patch
• http://ubuntu.com/usn/usn-1289-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070518.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4349 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070450.html · Vendor Advisory
• http://secunia.com/advisories/47160 · Vendor Advisory
• http://secunia.com/advisories/46940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4349 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10103-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4349 · Vendor Advisory
• http://gitorious.org/colord/master/commit/1fadd90afcb4bbc47513466ee9bb1e4a8632ac3b · Note
• http://openwall.com/lists/oss-security/2011/11/25/3 · Note
• https://suse.com/security/cve/CVE-2011-4349 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=757171 · Note