CVE-2021-42523: 
NixOS vulnerability analysis and mitigation

There are two Information Disclosure vulnerabilities in colord, identified as CVE-2021-42523, located in colord/src/cd-device-db.c and colord/src/cd-profile-db.c files. The vulnerability was disclosed on August 25, 2022, affecting colord versions 1.4.4 and 1.4.5 (NVD).

The vulnerability stems from a memory leak where the 'err_msg' parameter of 'sqlite3_exec' is not properly released after use, despite libxml2's requirement that the caller must release it. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) (NVD, Snyk).

The vulnerability results in a potential information disclosure, where there could be a total loss of confidentiality, potentially resulting in all resources within the impacted component being divulged to the attacker. The vulnerability is remotely exploitable and requires no special privileges or user interaction (Snyk).

As of the available information, there is no fixed version reported for affected systems. The vulnerability was initially reported and tracked through GitHub issue #110 (Github Issue).