CVE Vulnerabilities

CVE-2022-1215

Use of Externally-Controlled Format String

Published: Jun 02, 2022 | Modified: Nov 21, 2024
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
7.8 MODERATE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

A format string vulnerability was found in libinput

Weakness

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected Software

Name Vendor Start Version End Version
Libinput Freedesktop 1.10.0 (including) 1.18.2 (excluding)
Libinput Freedesktop 1.19.0 (including) 1.19.4 (excluding)
Libinput Freedesktop 1.20.0 (including) 1.20.0 (including)
Red Hat Enterprise Linux 8 RedHat libinput-0:1.16.3-3.el8_6 *
Red Hat Enterprise Linux 9 RedHat libinput-0:1.19.3-2.el9_0 *
Libinput Ubuntu bionic *
Libinput Ubuntu esm-infra/bionic *
Libinput Ubuntu esm-infra/focal *
Libinput Ubuntu focal *
Libinput Ubuntu impish *
Libinput Ubuntu jammy *
Libinput Ubuntu upstream *

Potential Mitigations

References