CVE catalog

CVE-2021-42523

colord: CVE-2021-42523

[CVE catalog]

Severity
Medium · CVSS 4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.94% · Oct 25, 2026

There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancolordsid1.4.8-3fixed
Debiancolordforky1.4.8-3fixed
Debiancolordtrixie1.4.7-3fixed
Debiancolordbookworm1.4.6-2.2fixed
Susecolordlinux enterprise module for basesystem 15 sp61.4.6-150600.3.8.1fixed
Susecolordlinux enterprise module for basesystem 15 sp71.4.6-150600.3.8.1fixed
Susecolordlinux enterprise module for desktop applications 15 sp61.4.6-150600.3.8.1fixed
Susecolordlinux enterprise module for desktop applications 15 sp71.4.6-150600.3.8.1fixed
Susecolordlinux enterprise module for package hub 15 sp61.4.6-150600.3.8.1fixed
Susecolordlinux enterprise module for package hub 15 sp71.4.6-150600.3.8.1fixed
Susecolordlinux enterprise workstation extension 15 sp61.4.6-150600.3.8.1fixed
Susecolordlinux enterprise workstation extension 15 sp71.4.6-150600.3.8.1fixed
Opensusecolordleap 15.61.4.6-150600.3.8.1fixed
Susecolordlinux micro 6.11.4.6-slfo.1.1_2.1fixed
Susecolordlinux micro 6.01.4.6-4.1fixed
Susecolordlinux enterprise server 12 sp5-ltss1.3.3-13.9.2fixed
Susecolordlinux enterprise server ltss extended security 12 sp51.3.3-13.9.2fixed
Susecolordlinux enterprise micro 5.31.4.5-150400.4.3.1fixed
Susecolordlinux enterprise module for basesystem 15 sp41.4.5-150400.4.3.1fixed
Susecolordlinux enterprise module for desktop applications 15 sp41.4.5-150400.4.3.1fixed
Susecolordlinux enterprise workstation extension 15 sp41.4.5-150400.4.3.1fixed
Opensusecolordleap 15.41.4.5-150400.4.3.1fixed
Susecolordlinux enterprise software development kit 12 sp51.3.3-13.3.1fixed
Susecolordlinux enterprise server 12 sp51.3.3-13.3.1fixed
Susecolordlinux enterprise server for sap applications 12 sp51.3.3-13.3.1fixed
Susecolordlinux enterprise workstation extension 12 sp51.3.3-13.3.1fixed
Susecolordlinux enterprise module for basesystem 15 sp31.4.4-150200.4.6.1fixed
Susecolordlinux enterprise module for desktop applications 15 sp31.4.4-150200.4.6.1fixed
Susecolordlinux enterprise workstation extension 15 sp31.4.4-150200.4.6.1fixed
Susecolordlinux enterprise micro 5.21.4.4-150200.4.6.1fixed
Opensusecolordleap micro 5.21.4.4-150200.4.6.1fixed
Opensusecolordleap 15.31.4.4-150200.4.6.1fixed
Opensusecolordtumbleweed1.4.6-2.1fixed
Susecolordlinux enterprise micro 5.31.4.5-150400.4.9.1fixed
Susecolordlinux enterprise micro 5.41.4.5-150400.4.9.1fixed
Susecolordlinux enterprise micro 5.51.4.5-150400.4.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancolordsourcesid1.4.6-1unimportantNot reportedNot reported
Debiancolordsourceforky1.4.6-1unimportantNot reportedNot reported
Debiancolordsourcetrixie1.4.6-1unimportantNot reportedNot reported
Debiancolordsourcebookworm1.4.6-1unimportantNot reportedNot reported
Susecolordrpmlinux enterprise module for basesystem 15 sp61.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux enterprise module for basesystem 15 sp71.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux enterprise module for desktop applications 15 sp61.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux enterprise module for desktop applications 15 sp71.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux enterprise module for package hub 15 sp61.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux enterprise module for package hub 15 sp71.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux enterprise workstation extension 15 sp61.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux enterprise workstation extension 15 sp71.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Opensusecolordrpmleap 15.61.4.6-150600.3.8.1Not reportedSUSE-SU-2025:3949-1Not reported
Susecolordrpmlinux micro 6.11.4.6-slfo.1.1_2.1Not reportedSUSE-SU-2025:20964-1Not reported
Susecolordrpmlinux micro 6.01.4.6-4.1Not reportedSUSE-SU-2025:20935-1Not reported
Susecolordrpmlinux enterprise server 12 sp5-ltss1.3.3-13.9.2Not reportedSUSE-SU-2025:4483-1Not reported
Susecolordrpmlinux enterprise server ltss extended security 12 sp51.3.3-13.9.2Not reportedSUSE-SU-2025:4483-1Not reported
Susecolordrpmlinux enterprise micro 5.31.4.5-150400.4.3.1Not reportedSUSE-SU-2022:3496-1Not reported
Susecolordrpmlinux enterprise module for basesystem 15 sp41.4.5-150400.4.3.1Not reportedSUSE-SU-2022:3496-1Not reported
Susecolordrpmlinux enterprise module for desktop applications 15 sp41.4.5-150400.4.3.1Not reportedSUSE-SU-2022:3496-1Not reported
Susecolordrpmlinux enterprise workstation extension 15 sp41.4.5-150400.4.3.1Not reportedSUSE-SU-2022:3496-1Not reported
Opensusecolordrpmleap 15.41.4.5-150400.4.3.1Not reportedSUSE-SU-2022:3496-1Not reported
Susecolordrpmlinux enterprise software development kit 12 sp51.3.3-13.3.1Not reportedSUSE-SU-2022:4410-1Not reported
Susecolordrpmlinux enterprise server 12 sp51.3.3-13.3.1Not reportedSUSE-SU-2022:4410-1Not reported
Susecolordrpmlinux enterprise server for sap applications 12 sp51.3.3-13.3.1Not reportedSUSE-SU-2022:4410-1Not reported
Susecolordrpmlinux enterprise workstation extension 12 sp51.3.3-13.3.1Not reportedSUSE-SU-2022:4410-1Not reported
Susecolordrpmlinux enterprise module for basesystem 15 sp31.4.4-150200.4.6.1Not reportedSUSE-SU-2022:4170-1Not reported
Susecolordrpmlinux enterprise module for desktop applications 15 sp31.4.4-150200.4.6.1Not reportedSUSE-SU-2022:4170-1Not reported
Susecolordrpmlinux enterprise workstation extension 15 sp31.4.4-150200.4.6.1Not reportedSUSE-SU-2022:4170-1Not reported
Susecolordrpmlinux enterprise micro 5.21.4.4-150200.4.6.1Not reportedSUSE-SU-2022:4170-1Not reported
Opensusecolordrpmleap micro 5.21.4.4-150200.4.6.1Not reportedSUSE-SU-2022:4170-1Not reported
Opensusecolordrpmleap 15.31.4.4-150200.4.6.1Not reportedSUSE-SU-2022:4170-1Not reported
Opensusecolordrpmtumbleweed1.4.6-2.1Not reportedOPENSUSE-SU-2024:12353-1Not reported
Susecolordrpmlinux enterprise micro 5.31.4.5-150400.4.9.1Not reportedSUSE-SU-2025:3899-1Not reported
Susecolordrpmlinux enterprise micro 5.41.4.5-150400.4.9.1Not reportedSUSE-SU-2025:3899-1Not reported
Susecolordrpmlinux enterprise micro 5.51.4.5-150400.4.9.1Not reportedSUSE-SU-2025:3899-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [colord-color-profiles]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · noarch · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

  • [colord-lang]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · noarch · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

  • [libcolord2]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

  • [libcolord2-32bit]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

  • [libcolord-devel]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

  • [libcolorhug2]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

  • [typelib-1_0-Colord-1_0]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

  • [typelib-1_0-Colorhug-1_0]Unknown

    Source package: [colord]

    Details (1)

    • 1.4.8-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.6-2.1

      Version impact unknown

      dsa · colord · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [colord]Fixed
    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [colord-data]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · all · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · all · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [colord-sensor-argyll]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [colord-tests]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [gir1.2-colord-1.0]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [gir1.2-colorhug-1.0]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [libcolord2]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [libcolord-dev]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [libcolorhug2]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

  • [libcolorhug-dev]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.6-2.2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

    • 1.4.6-2.2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · bookworm; dsa · colord · debian · 12

[Debian 13 (Trixie)]

  • [colord]Fixed
    Details (2)

    • 1.4.7-3 · amd64 · trixie

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · 13

    • 1.4.7-3 · arm64 · trixie

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · 13

  • [colord-data]Fixed

    Source package: [colord]

    Details (2)

    • 1.4.7-3 · all · trixie

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · 13

    • 1.4.7-3 · all · trixie

      Fixed · Fixed: 1.4.6-1

      dsa · colord · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]