PatchTheCVElibxkbcommon vulnerabilities and fixes
Recent CVEs affecting libxkbcommon, with upgrade or downgrade steps. 8 tracked.
libxkbcommon has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2018-08-25. Highest priority: CVE-2018-15857 (score 42/100).
- CVE-2018-15864 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by
- CVE-2018-15863 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could b
- CVE-2018-15862 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by loc
- CVE-2018-15861 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by lo
- CVE-2018-15859 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon befor
- CVE-2018-15858 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in
- CVE-2018-15857 HIGH 7.8 UPGRADE UPGRADE An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by
- CVE-2018-15853 MEDIUM 5.5 UPGRADE UPGRADE Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by
FAQ
How do I fix libxkbcommon vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libxkbcommon being exploited right now?
None of the tracked libxkbcommon CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libxkbcommon CVE should I patch first?
CVE-2018-15857 currently ranks highest (42/100): An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by.