CVE-2014-1422
Location service uses cached authorization even after revocation
- State
- Published
- Severity
- 5.0 Medium
- Published
- Jul 22, 2020
- Updated
- Sep 17, 2024
- Reserved
- Jan 13, 2014
Description
In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.0 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | canonical |
Weaknesses
- CWE-275 Permission Issues
Affected Products
| Product | Versions |
|---|---|
trust-store (Ubuntu)Canonical |
|
trust-store (Ubuntu RTM)Canonical |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.