CVE-2022-1215 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 12%

Affected Products (NVD)

Vendor	Product	Version
freedesktop	libinput	1.10.0 ≤ 𝑥 < 1.18.2
freedesktop	libinput	1.19.0 ≤ 𝑥 < 1.19.4
freedesktop	libinput	1.20.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libinput

bookworm	1.22.1-1 fixed
bullseye	no-dsa
buster	no-dsa
sid	1.26.2-1 fixed
stretch	not-affected
trixie	1.26.2-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

libinput

bionic	Fixed 1.10.4-1ubuntu0.18.04.3 released
focal	Fixed 1.15.5-1ubuntu0.3 released
impish	Fixed 1.18.1-1ubuntu0.1 released
jammy	Fixed 1.20.0-1ubuntu0.1 released
kinetic	not-affected
lunar	not-affected
xenial	not-affected

Common Weakness Enumeration

CWE-134 - Use of Externally-Controlled Format String
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.

References

https://seclists.org/oss-sec/2022/q2/47

https://security.gentoo.org/glsa/202310-14

https://seclists.org/oss-sec/2022/q2/47

https://security.gentoo.org/glsa/202310-14