Debian Package Tracker - libxkbcommon

general

source: libxkbcommon (main)
version: 0.8.2-1
maintainer: Debian X Strike Force (archive) [DMD]
uploaders: Michael Stapelberg [DMD]
arch: all any
std-ver: 3.9.8
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 0.4.3-2
stable: 0.7.1-2~deb9u1
testing: 0.8.2-1
unstable: 0.8.2-1

versioned links

0.4.3-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.7.1-2~deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.8.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libxkbcommon-dev
libxkbcommon-doc
libxkbcommon-x11-0
libxkbcommon-x11-dev
libxkbcommon0

action needed

A new upstream version is available: 0.8.4 high

A new upstream version 0.8.4 is available, you should consider packaging it.

Created: 2019-02-09 Last update: 2019-05-22 03:06

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.3.0 instead of 3.9.8).

Created: 2017-09-16 Last update: 2018-12-23 17:14

lintian reports 6 warnings high

Lintian reports 6 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-05-21 Last update: 2018-08-31 05:19

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 0.8.2-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 4219a8c759513d1dcab20150178680aad11241e9
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu Sep 27 11:04:51 2018 +0300

    source: Bump to format 3.0, upstream provides only .xz tarballs.

Created: 2018-09-28 Last update: 2019-05-21 18:03

11 ignored security issues in jessie low

There are 11 open security issues in jessie.

11 issues skipped by the security teams:

CVE-2018-15858: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.
CVE-2018-15861: Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.
CVE-2018-15854: Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.
CVE-2018-15863: Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.
CVE-2018-15855: Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled.
CVE-2018-15864: Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.
CVE-2018-15862: Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.
CVE-2018-15853: Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.
CVE-2018-15859: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.
CVE-2018-15856: An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.
CVE-2018-15857: An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.

Please fix them.

Created: 2018-08-26 Last update: 2018-09-04 07:14

11 ignored security issues in stretch low

There are 11 open security issues in stretch.

11 issues skipped by the security teams:

CVE-2018-15858: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.
CVE-2018-15861: Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.
CVE-2018-15854: Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.
CVE-2018-15863: Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.
CVE-2018-15855: Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled.
CVE-2018-15864: Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.
CVE-2018-15862: Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.
CVE-2018-15853: Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.
CVE-2018-15859: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.
CVE-2018-15856: An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.
CVE-2018-15857: An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.

Please fix them.

Created: 2018-08-26 Last update: 2018-09-04 07:14

news

[rss feed]

[2018-09-04] libxkbcommon 0.8.2-1 MIGRATED to testing (Debian testing watch)
[2018-08-30] Accepted libxkbcommon 0.8.2-1 (source) into unstable (Timo Aaltonen)
[2018-06-12] libxkbcommon 0.8.0-2 MIGRATED to testing (Debian testing watch)
[2018-06-06] Accepted libxkbcommon 0.8.0-2 (source amd64 all) into unstable, unstable (Timo Aaltonen)
[2018-01-08] libxkbcommon 0.8.0-1 MIGRATED to testing (Debian testing watch)
[2018-01-02] Accepted libxkbcommon 0.8.0-1 (source) into unstable (Timo Aaltonen)
[2017-11-29] Accepted libxkbcommon 0.7.1-2~deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Andreas Beckmann)
[2017-09-21] libxkbcommon 0.7.1-2 MIGRATED to testing (Debian testing watch)
[2017-09-16] Accepted libxkbcommon 0.7.1-2 (source) into unstable (Julien Cristau)
[2017-01-29] libxkbcommon 0.7.1-1 MIGRATED to testing (Debian testing watch)
[2017-01-18] Accepted libxkbcommon 0.7.1-1 (source) into unstable (Emilio Pozuelo Monfort)
[2016-12-18] libxkbcommon 0.7.0-1 MIGRATED to testing (Debian testing watch)
[2016-12-07] Accepted libxkbcommon 0.7.0-1 (source) into unstable (Emilio Pozuelo Monfort)
[2016-08-28] libxkbcommon 0.6.1-1 MIGRATED to testing (Debian testing watch)
[2016-08-22] Accepted libxkbcommon 0.6.1-1 (source amd64) into unstable (Michael Stapelberg)
[2015-05-24] libxkbcommon 0.5.0-1 MIGRATED to testing (Britney)
[2015-05-18] Accepted libxkbcommon 0.5.0-1 (source amd64) into unstable (Michael Stapelberg)
[2014-09-19] libxkbcommon 0.4.3-2 MIGRATED to testing (Britney)
[2014-09-16] Accepted libxkbcommon 0.4.3-2 (source amd64) into unstable (Emilio Pozuelo Monfort)
[2014-09-05] Accepted libxkbcommon 0.4.3-1 (source amd64) into unstable (Emilio Pozuelo Monfort)
[2014-07-28] libxkbcommon 0.4.1-2 MIGRATED to testing (Britney)
[2014-07-23] Accepted libxkbcommon 0.4.1-2 (source amd64) (Michael Stapelberg)
[2014-07-18] Accepted libxkbcommon 0.4.1-1 (source amd64) (Michael Stapelberg)
[2014-02-21] libxkbcommon 0.4.0-1 MIGRATED to testing (Debian testing watch)
[2014-02-10] Accepted libxkbcommon 0.4.0-1 (source amd64) (Michael Stapelberg)
[2013-09-20] libxkbcommon 0.3.1-2 MIGRATED to testing (Debian testing watch)
[2013-09-10] Accepted libxkbcommon 0.3.1-2 (source amd64) (Emilio Pozuelo Monfort)
[2013-06-19] libxkbcommon 0.3.1-1 MIGRATED to testing (Debian testing watch)
[2013-06-09] Accepted libxkbcommon 0.3.1-1 (source amd64) (Emilio Pozuelo Monfort)
[2012-02-10] Accepted libxkbcommon 0.1.0~1-1 (source amd64) (Cyril Brulebois)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 6)
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.8.2-1
2 bugs