CVE-2014-1422

MEDIUM

Ubuntu Trust Store <1.1.0+15.04.20150123 - Info Disclosure

Title source: llm
STIX 2.1

Description

In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.

References (2)

Core 2
Core References
Exploit, Patch, Third Party Advisory x_refsource_confirm
https://launchpad.net/bugs/1387734
Patch, Third Party Advisory x_refsource_confirm
https://bazaar.launchpad.net/~phablet-team/trust-store/trunk/revision/82

Scores

CVSS v3 5.0
EPSS 0.0004
EPSS Percentile 12.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-275 CWE-732
Status published
Products (2)
canonical/trust-store_\(ubuntu\) < 1.1.0
canonical/trust-store_\(ubuntu_rtm\) < 1.1.0
Published Jul 22, 2020
Tracked Since Feb 18, 2026