CVE-2022-1215

A format string vulnerability was found in libinput

libinput is a library to handle input devices in Wayland compositors and to provide a generic X.Org input driver.It provides device detection, device handling, input device event processing and abstraction so minimize the amount of custom input code compositors need to provide the common set of functionality that users expect.

Security Fix(es):

A format string vulnerability was found in libinput(CVE-2022-1215)

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices.

Security Fix(es):

• libinput: format string vulnerability may lead to privilege escalation (CVE-2022-1215)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices.

Security Fix(es):

• libinput: format string vulnerability may lead to privilege escalation (CVE-2022-1215)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A format string vulnerability was found in libinput

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es):

• libinput: format string vulnerability may lead to privilege escalation (CVE-2022-1215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2022-1215: strip format directives from device name

A format string vulnerability was found in libinput

libinput could be made to crash or expose sensitive information. (CVE-2022-1215)

These are all security issues fixed in the libinput-devel-1.20.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libinput fixes the following issues:

• CVE-2022-1215: Fixed a format string vulnerability (bsc#1198111).

Albin Eldstål-Ahrens and Lukas Lamster discovered libinput did not properly handle input devices with specially crafted names. A local attacker with physical access could use this to cause libinput to crash or expose sensitive information.

USN-5382-1 fixed a vulnerability in libinput. This update provides the corresponding updates for Ubuntu 22.04 LTS.

Original advisory details:

Albin Eldstål-Ahrens and Lukas Lamster discovered libinput did not properly handle input devices with specially crafted names. A local attacker with physical access could use this to cause libinput to crash or expose sensitive information.