Back
CVE-2014-1422
Location service uses cached authorization even after revocation
Medium5.0EPSS 0.37%
- Published
- Updated
- Reserved
- Assigned by
- canonical
Description
In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| canonicalCNA (assigner) | 3.1 | Medium5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.37% · top 69% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.
Weakness
Affected products
Canonical · trust-store (Ubuntu)
- affected 1.1.0 – < 1.1.0+15.04.20150123-0ubuntu1
Canonical · trust-store (Ubuntu RTM)
- affected 1.1.0 – < 1.1.0+15.04.20150123~rtm-0ubuntu1
References (2)
- https://launchpad.net/bugs/1387734 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://bazaar.launchpad.net/~phablet-team/trust-store/trunk/revision/82 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2014-1422)Record last updated .