CVE-2018-15853

Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.

References

Affected packages

Debian:11 / libxkbcommon

Package

Name: libxkbcommon
Purl: pkg:deb/debian/libxkbcommon?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.2-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / libxkbcommon

Package

Name: libxkbcommon
Purl: pkg:deb/debian/libxkbcommon?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.2-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / libxkbcommon

Package

Name: libxkbcommon
Purl: pkg:deb/debian/libxkbcommon?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.2-1

Ecosystem specific

{
    "urgency": "low"
}

Git / github.com/xkbcommon/libxkbcommon

Affected ranges

Type: GIT
Repo: https://github.com/xkbcommon/libxkbcommon
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1f9d1248c07cda8aaff762429c0dce146de8632a

Affected versions

xkbcommon-0.*

xkbcommon-0.2.0

xkbcommon-0.3.0

xkbcommon-0.3.1

xkbcommon-0.3.2

xkbcommon-0.4.0

xkbcommon-0.4.1

xkbcommon-0.4.2

xkbcommon-0.4.3

xkbcommon-0.5.0

xkbcommon-0.6.0

xkbcommon-0.6.1

xkbcommon-0.7.0

xkbcommon-0.7.1

xkbcommon-0.7.2

xkbcommon-0.8.0