PatchTheCVExkbcommon vulnerabilities and fixes
Recent CVEs affecting xkbcommon, with upgrade or downgrade steps. 11 tracked.
xkbcommon has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 11. Most recent: 2018-08-25. Highest priority: CVE-2018-15857 (score 42/100).
- CVE-2018-15864 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by
- CVE-2018-15863 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could b
- CVE-2018-15862 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by loc
- CVE-2018-15861 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by lo
- CVE-2018-15859 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon befor
- CVE-2018-15858 MEDIUM 5.5 UPGRADE UPGRADE Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in
- CVE-2018-15857 HIGH 7.8 UPGRADE UPGRADE An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by
- CVE-2018-15856 MEDIUM 5.5 UPGRADE MITIGATE An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon befor
- CVE-2018-15855 MEDIUM 5.5 UPGRADE MITIGATE Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer
- CVE-2018-15854 MEDIUM 5.5 UPGRADE MITIGATE Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer
- CVE-2018-15853 MEDIUM 5.5 UPGRADE UPGRADE Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by
FAQ
How do I fix xkbcommon vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xkbcommon being exploited right now?
None of the tracked xkbcommon CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xkbcommon CVE should I patch first?
CVE-2018-15857 currently ranks highest (42/100): An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by.