VulnerabilityModified
CVE-2018-15854
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.
MEDIUM 5.5EPSS 0.43%
Does this matter?
Lower severity and a low EPSS score (0.43%). Track it; it rarely justifies an emergency change on its own.
Description
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.43% probability · 37th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-476
- Affected
- xkbcommon project/xkbcommon · canonical/ubuntu linux
- Source
- cve@mitre.org
References
- https://access.redhat.com/errata/RHSA-2019:2079
- https://github.com/xkbcommon/libxkbcommon/commit/e3cacae7b1bfda0d839c280494f23284a1187adfPatch, Third Party Advisory
- https://lists.freedesktop.org/archives/wayland-devel/2018-August/039232.htmlThird Party Advisory
- https://security.gentoo.org/glsa/201810-05Third Party Advisory
- https://usn.ubuntu.com/3786-1/Third Party Advisory
- https://usn.ubuntu.com/3786-2/Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2079
- https://github.com/xkbcommon/libxkbcommon/commit/e3cacae7b1bfda0d839c280494f23284a1187adfPatch, Third Party Advisory
- https://lists.freedesktop.org/archives/wayland-devel/2018-August/039232.htmlThird Party Advisory
- https://security.gentoo.org/glsa/201810-05Third Party Advisory
- https://usn.ubuntu.com/3786-1/Third Party Advisory
- https://usn.ubuntu.com/3786-2/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.