CVE-2011-4349 Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices an...
MediumCVSS 4.6
EPSS 0.45%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/colord(Debian:12) | < 0.1.15-1 | 0.1.15-1 |
| debian/colord(Debian:13) | < 0.1.15-1 | 0.1.15-1 |
| debian/colord(Debian:14) | < 0.1.15-1 | 0.1.15-1 |
| freedesktop colord | <= 0.1.14 | No fix listed |
| freedesktop colord | = 0.1.0 | No fix listed |
| freedesktop colord | = 0.1.1 | No fix listed |
| freedesktop colord | = 0.1.2 | No fix listed |
| freedesktop colord | = 0.1.3 | No fix listed |
| freedesktop colord | = 0.1.4 | No fix listed |
| freedesktop colord | = 0.1.5 | No fix listed |
| freedesktop colord | = 0.1.6 | No fix listed |
| freedesktop colord | = 0.1.7 | No fix listed |
| freedesktop colord | = 0.1.8 | No fix listed |
| freedesktop colord | = 0.1.9 | No fix listed |
| freedesktop colord | = 0.1.10 | No fix listed |
| freedesktop colord | = 0.1.11 | No fix listed |
| freedesktop colord | = 0.1.12 | No fix listed |
| freedesktop colord | = 0.1.13 | No fix listed |
References
- Debian Security Tracker CVE-2011-4349 vendor-advisory
- gitorious.org
- gitorious.org
- FEDORA-2011-16453 vendor-advisory
- FEDORA-2011-16451 vendor-advisory
- 46940 third-party-advisory vendor-advisory
- 47160 third-party-advisory vendor-advisory
- USN-1289-1 vendor-advisory
- [oss-security] 20111125 Re: CVE Request: colord sql injections mailing-list
- [oss-security] 20111125 Re: CVE Request: colord sql injections mailing-list
- 50814 vdb-entry
- bugs.freedesktop.org patch
- bugzilla.redhat.com
- bugs.debian.org issue-tracking