CVE-2018-15857 describes an invalid free vulnerability in xkbcommon versions prior to 0.8.1, specifically within the ExprAppendMultiKeysymList function. This flaw allows local attackers to crash xkbcommon keymap parsers or potentially achieve other unspecified impacts by providing a specially crafted keymap file. Rated with a CVSS score of 7.8 (HIGH), this vulnerability has a low attack complexity and requires local user privileges, but can lead to high impacts on confidentiality, integrity, and availability. The EPSS score is very low, indicating a minimal likelihood of exploitation in the wild. There is no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB. Furthermore, the CVE has received no community discussion or media coverage, suggesting a low level of public awareness or concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.8.1CPE matchmatch criteria | cpe:2.3:a:xkbcommon:libxkbcommon:*:*:*:*:*:*:*:* | ||
< 0.8.1CPE matchmatch criteria | cpe:2.3:a:xkbcommon:xkbcommon:*:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.