bugzilla.redhat.com
Open in
urlscan Pro
2a02:26f0:3500:894::762
Public Scan
URL:
https://bugzilla.redhat.com/show_bug.cgi?id=1962836
Submission: On April 06 via api from US — Scanned from DE
Submission: On April 06 via api from US — Scanned from DE
Form analysis 5 forms found in the DOM
POST show_bug.cgi?id=1962836
<form action="show_bug.cgi?id=1962836" method="POST" class="mini_login " id="mini_login">
<input id="Bugzilla_login" required="" name="Bugzilla_login" class="bz_login" type="email" placeholder="Email Address">
<input class="bz_password" name="Bugzilla_password" type="password" id="Bugzilla_password" required="" placeholder="Password">
<input type="hidden" name="Bugzilla_login_token" value="">
<input type="submit" name="GoAheadAndLogIn" value="Log in" id="log_in">
</form>POST token.cgi
<form action="token.cgi" method="post" id="forgot_form" class="mini_forgot bz_default_hidden">
<label for="login">Login:</label>
<input name="loginname" size="20" id="login" required="" type="email" placeholder="Your Email Address">
<input id="forgot_button" value="Reset Password" type="submit">
<input type="hidden" name="a" value="reqpw">
<input type="hidden" id="token" name="token" value="1649262592-GZ3VEWQm_WbLzc8f8d_S6YKxcn7OmpjVNXZwCgdeBk4">
<p>
<a href="#" onclick="return hide_forgot_form('')"><i class="fa fa-exclamation-triangle" aria-hidden="true"></i> Hide Forgot</a>
</p>
</form>GET buglist.cgi
<form action="buglist.cgi" method="get" onsubmit="if (this.quicksearch.value == '')
{ alert('Please enter one or more search terms first.');
return false; } return true;">
<input type="hidden" id="no_redirect_top" name="no_redirect" value="1">
<script type="text/javascript">
if (history && history.replaceState) {
var no_redirect = document.getElementById("no_redirect_top");
no_redirect.value = 1;
}
</script>
<input class="txt" type="text" id="quicksearch_top" name="quicksearch" title="Quick Search" value="">
<input class="btn" type="submit" value="Search" id="find_top">
</form>Name: changeform — POST process_bug.cgi
<form name="changeform" id="changeform" method="post" action="process_bug.cgi">
<input type="hidden" name="delta_ts" value="2022-03-25 08:35:18">
<input type="hidden" name="id" value="1962836">
<input type="hidden" name="token" value="1649262592---XfV-Wy1j2KTxYeDCLUEG6YVY5UHlDA8iI5ww96hvo">
<div class="bz_short_desc_container edit_form">
<a href="show_bug.cgi?id=1962836"><b>Bug 1962836</b></a> <span id="summary_container"> (<span id="alias_nonedit_display">CVE-2021-3567</span>) - <span
id="short_desc_nonedit_display"><a href="https://access.redhat.com/security/cve/CVE-2021-3567">CVE-2021-3567</a> caribou: segfault on pressing ē since Xorg <a href="https://access.redhat.com/security/cve/CVE-2020-25712">CVE-2020-25712</a>
fix</span>
</span>
<div id="summary_input" class="bz_default_hidden"><span class="field_label " id="field_label_short_desc">
<a title="The bug summary is a short sentence which succinctly describes what the bug is about." class="field_help_link" href="page.cgi?id=fields.html#short_desc">Summary:</a>
</span>CVE-2021-3567 caribou: segfault on pressing ē since Xorg CVE-2020-25712 fix </div>
</div>
<script type="text/javascript">
hideEditableField('summary_container', 'summary_input', 'summary_edit_action', 'short_desc', 'CVE-2021-3567 caribou: segfault on pressing ē since Xorg CVE-2020-25712 fix');
</script>
<table class="edit_form">
<tbody>
<tr>
<td id="bz_show_bug_column_1" class="bz_show_bug_column">
<table>
<tbody>
<tr>
<th class="field_label">
<a href="describekeywords.cgi">Keywords</a>:
</th>
<td>
<div class="keywords_select">
<select id="keywords" name="keywords" disabled="" multiple="multiple" tabindex="-1" class="selectized" style="display: none;">
<option value="Security" selected="selected">Security </option>
</select>
<div class="selectize-control multi plugin-remove_button plugin-minimum_search_length plugin-extra_keys_control plugin-related_fields plugin-load_from_js">
<div class="selectize-input items not-full has-options has-items disabled locked">
<div class="item"
title="Bugs with the "Security" keyword are those that relate to a security vulnerability with a Red Hat product or service. For further information on how to report a security vulnerability to Red Hat please see the "Security Contacts and Procedures" page at http://www.redhat.com/security/team/contact/"
data-value="Security">Security <a href="javascript:void(0)" class="remove" tabindex="-1" title="Remove">×</a></div><input type="select-multiple" autocomplete="off" tabindex="-1" id="keywords-selectized" disabled=""
style="width: 4px;">
</div>
<div class="selectize-dropdown multi plugin-remove_button plugin-minimum_search_length plugin-extra_keys_control plugin-related_fields plugin-load_from_js" style="display: none;">
<div class="selectize-dropdown-content"></div>
</div>
</div>
</div>
</td>
</tr>
<tr>
<th class="field_label">
<a href="page.cgi?id=fields.html#bug_status">Status</a>:
</th>
<td id="bz_field_status">
<span id="static_bug_status">CLOSED WONTFIX </span>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_alias">
<a title="A short, unique name assigned to a bug in order to assist with looking it up and referring to it in other places in Bugzilla." class="field_help_link" href="page.cgi?id=fields.html#alias">Alias:</a>
</th>
<td>CVE-2021-3567 </td>
</tr>
<tr>
<th class="field_label " id="field_label_product">
<a title="Bugs are categorised into Products and Components. Select a Classification to narrow down this list." class="field_help_link" href="describecomponents.cgi">Product:</a>
</th>
<td class="field_value " id="field_container_product">Security Response </td>
</tr>
<tr class="bz_default_hidden">
<th class="field_label " id="field_label_classification">
<a title="Bugs are categorised into Classifications, Products and Components. classifications is the top-level categorisation." class="field_help_link" href="page.cgi?id=fields.html#classification">Classification:</a>
</th>
<td class="field_value " id="field_container_classification">Other </td>
</tr>
<tr>
<th class="field_label " id="field_label_component">
<a title="Components are second-level categories; each belongs to a particular Product. Select a Product to narrow down this list." class="field_help_link" href="describecomponents.cgi?product=Security Response">Component:</a>
</th>
<td>
<input type="hidden" id="component" name="component" value="vulnerability">vulnerability <span class="show_others">
<a href="buglist.cgi?component=vulnerability&product=Security%20Response" title="Show other bugs for this component"><i class="fas fa-th-list"></i></a>
<a href="enter_bug.cgi?component=vulnerability&product=Security%20Response&version=unspecified" title="Create a new bug for this component"><i class="fas fa-plus-circle"></i></a>
</span>
</td>
</tr>
<tr>
<th id="bz_rh_sub_component_input_th" class="field_label bz_default_hidden">
<label for="rh_sub_component-selectized" class="selectized">
<a class="field_help_link" href="page.cgi?id=fields.html#rh_sub_components" title="The sub component of a specific component">Sub Component:</a>
</label>
</th>
<td id="bz_rh_sub_component_input_td" class="bz_default_hidden">
<input type="hidden" name="defined_rh_sub_component" id="defined_rh_sub_component" value="0">
<select name="rh_sub_component" id="rh_sub_component" disabled="" onchange="assign_to_default();" placeholder="Type a sub-component name" tabindex="-1" class="selectized" style="display: none;">
<option value="" selected="selected"></option>
</select>
<div class="selectize-control single plugin-remove_button plugin-minimum_search_length plugin-extra_keys_control plugin-form_history plugin-related_fields">
<div class="selectize-input items not-full disabled locked"><input type="select-one" autocomplete="off" tabindex="-1" id="rh_sub_component-selectized" placeholder="Type a sub-component name" disabled="" style="width: 172.391px;">
</div>
<div class="selectize-dropdown single plugin-remove_button plugin-minimum_search_length plugin-extra_keys_control plugin-form_history plugin-related_fields" style="display: none;">
<div class="selectize-dropdown-content"></div>
</div>
</div>
<script>
$(document).ready(function() {
if (!$('#rh_sub_component').hasClass('selectized')) {
init_sub_components();
}
});
</script>
<span class="show_others">
<a href="buglist.cgi?component=vulnerability&product=Security%20Response" title="Show other bugs for this sub-component"><i class="fas fa-th-list"></i></a>
</span>
</td>
</tr>
<script>
function rh_check_sub_components() {
var ret = '';
var sub_comp_obj = document.getElementById('rh_sub_component');
if ($('#defined_rh_sub_component').val() == 1 && !$("#rh_sub_component").selectize()[0].selectize.getValue()) {
if (!ret) ret = sub_comp_obj;
_sub_comps_errorFor(sub_comp_obj, "You must specify the sub component");
}
return ret;
}
function _sub_comps_errorFor(field, error_text) {
var new_node = document.createElement('div');
YAHOO.util.Dom.addClass(new_node, 'validation_error_text');
new_node.innerHTML = error_text;
YAHOO.util.Dom.insertAfter(new_node, field);
YAHOO.util.Dom.addClass(field, 'validation_error_field');
new_node.scrollIntoView();
}
</script>
<tr>
<th class="field_label " id="field_label_version">
<a title="The version field defines the version of the software the bug was found in." class="field_help_link" href="page.cgi?id=fields.html#version">Version:</a>
</th>
<td>
<span id="version">unspecified </span>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_rep_platform">
<a title="The hardware platform the bug was observed on. Note: When searching, selecting the option "All" only finds bugs whose value for this field is literally the word "All"." class="field_help_link" href="page.cgi?id=fields.html#rep_platform">Hardware:</a>
</th>
<td class="field_value">All </td>
</tr>
<tr>
<th class="field_label " id="field_label_op_sys">
<a title="The operating system the bug was observed on. Note: When searching, selecting the option "All" only finds bugs whose value for this field is literally the word "All"." class="field_help_link" href="page.cgi?id=fields.html#op_sys">OS:</a>
</th>
<td class="field_value"> Linux </td>
</tr>
<tr>
<th class="field_label">
<label accesskey="i">
<a href="page.cgi?id=fields.html#priority">Priority:</a></label>
</th>
<td>medium </td>
</tr>
<tr>
<th class="field_label">
<label><a href="page.cgi?id=fields.html#bug_severity">Severity:</a>
</label>
</th>
<td> medium </td>
</tr>
<tr>
<th class="field_label " id="field_label_target_milestone">
<a title="The Target Milestone field is used to define when the engineer the bug is assigned to expects to fix it." class="field_help_link" href="page.cgi?id=fields.html#target_milestone">Target Milestone:</a>
</th>
<td>
<span id="target_milestone">--- </span>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_assigned_to">
<a title="The person in charge of resolving the bug." class="field_help_link" href="page.cgi?id=fields.html#assigned_to">Assignee:</a>
</th>
<td><span class="vcard redhat_user"><span class="fn">Red Hat Product Security</span>
</span>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_qa_contact">
<a title="The person responsible for confirming this bug if it is unconfirmed, and for verifying the fix once the bug has been resolved." class="field_help_link" href="page.cgi?id=fields.html#qa_contact">QA Contact:</a>
</th>
<td><span class="vcard ">
</span>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_docs_contact">
<label for="docs_contact" accesskey="q">
<a title="The person responsible for documenting once the bug has been resolved." class="field_help_link" href="page.cgi?id=fields.html#docs_contact">Docs Contact:</a>
</label>
</th>
<td><span class="vcard ">
</span>
</td>
</tr>
<script type="text/javascript">
assignToDefaultOnChange(['product', 'component'], 'security-response-team\x40redhat.com', '', '');
</script>
<tr>
<th class="field_label " id="field_label_bug_file_loc">
<a title="Bugs can have a URL associated with them - for example, a pointer to a web site where the problem is seen." class="field_help_link" href="page.cgi?id=fields.html#bug_file_loc">URL:</a>
</th>
<td>
<span id="bz_url_input_area">
</span>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_status_whiteboard">
<a title="Each bug has a free-form single line text entry box for adding tags and status information." class="field_help_link" href="page.cgi?id=fields.html#status_whiteboard">Whiteboard:</a>
</th>
<td>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_dependson">
<a title="The bugs listed here must be resolved before this bug can be resolved." class="field_help_link" href="page.cgi?id=fields.html#dependson">Depends On:</a>
</th>
<td>
<span id="dependson_input_area">
</span>
<a class="bz_bug_link
bz_status_CLOSED bz_closed
" title="CLOSED NOTABUG - caribou: configurable on screen keyboard with scanning mode [fedora-all]" href="show_bug.cgi?id=1962837">1962837</a> <a class="bz_bug_link
bz_status_CLOSED bz_closed
" title="CLOSED ERRATA - CVE-2021-3567 caribou: segfault on pressing ē since Xorg CVE-2020-25712 fix [epel-7]" href="show_bug.cgi?id=1962838">1962838</a>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_blocked">
<a title="This bug must be resolved before the bugs listed in this field can be resolved." class="field_help_link" href="page.cgi?id=fields.html#blocked">Blocks:</a>
</th>
<td>
<span id="blocked_input_area">
</span>
<a class="bz_bug_link
bz_secure
" title="" href="show_bug.cgi?id=1962839">1962839</a> <a class="bz_bug_link
bz_secure
" title="" href="show_bug.cgi?id=1965598">1965598</a>
</td>
</tr>
<tr>
<th class="field_label">TreeView+</th>
<td>
<a href="buglist.cgi?bug_id=1962836&bug_id_type=anddependson&format=tvp">
depends on</a> / <a href="buglist.cgi?bug_id=1962836&bug_id_type=andblocked&format=tvp&tvp_dir=blocked">
blocked</a>
</td>
<td></td>
</tr>
</tbody>
</table>
</td>
<td>
<div class="bz_column_spacer"> </div>
</td>
<td id="bz_show_bug_column_2" class="bz_show_bug_column">
<table>
<tbody>
<tr>
<th class="field_label">
<a href="page.cgi?id=fields.html#reporter">Reported:</a>
</th>
<td>2021-05-20 16:36 UTC by <span class="vcard redhat_user"><span class="fn">Guilherme de Almeida Suckevicz</span>
</span>
</td>
</tr>
<tr>
<th class="field_label">
<a href="page.cgi?id=fields.html#modified">Modified:</a>
</th>
<td>2022-03-25 08:35 UTC (<a href="show_activity.cgi?id=1962836">History</a>) </td>
</tr>
<tr>
<th class="field_label">
<label accesskey="a">
<a href="page.cgi?id=fields.html#cclist">CC List:</a>
</label>
</th>
<td>4 users <span id="cc_edit_area_showhide_container"> (<a href="#" id="cc_edit_area_showhide">show</a>) </span>
<div id="cc_edit_area" class="bz_default_hidden">
<br>
<select id="cc" multiple="multiple" size="5">
<option value="dueno">dueno</option>
<option value="jcpunk">jcpunk</option>
<option value="leigh123linux">leigh123linux</option>
<option value="pnemade">pnemade</option>
</select>
</div>
<script type="text/javascript">
hideEditableField('cc_edit_area_showhide_container', 'cc_edit_area', 'cc_edit_area_showhide', '', '');
</script>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_cf_fixed_in">
<a title="The full package version. PGM uses to check if brew ...">Fixed In Version:</a>
</th>
<td class="field_value " id="field_container_cf_fixed_in" colspan="2">caribou 0.4.21 </td>
</tr>
<tr>
<th class="field_label " id="field_label_cf_doc_type">
<a title="Click the information icon to the right to see the description">Doc Type:</a>
<i class="fas fa-info-circle pop-text" onclick="alertify.alert('Doc Type', BB_FIELDS['cf_doc_type'].long_desc)" title="Click to see full description"></i>
</th>
<td class="field_value " id="field_container_cf_doc_type" colspan="2">If docs needed, set a value <span id="cf_doc_warn"></span></td>
</tr>
<tr>
<th class="field_label " id="field_label_cf_release_notes">
<a title="Click the information icon to the right to see the description">Doc Text:</a>
<i class="fas fa-info-circle pop-text" onclick="alertify.alert('Doc Text', BB_FIELDS['cf_release_notes'].long_desc)" title="Click to see full description"></i>
</th>
<td class="field_value " id="field_container_cf_release_notes" colspan="2">
<div class="uneditable_textarea">A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen-locking applications that leverage Caribou as an input mechanism. The highest
threat from this vulnerability is to system availability.</div>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_cf_clone_of">
<a title="The bug listed here was the bug cloned to create thi...">Clone Of:</a>
</th>
<td class="field_value " id="field_container_cf_clone_of" colspan="2">
</td>
</tr>
<tr>
<th class="field_label " id="field_label_cf_environment">
<a title="This field is used for unformatted text that helps t...">Environment:</a>
</th>
<td class="field_value " id="field_container_cf_environment" colspan="2">
<div class="uneditable_textarea"></div>
</td>
</tr>
<tr>
<th class="field_label " id="field_label_cf_last_closed">
<a title="When this bug was last marked as closed. Used for st...">Last Closed:</a>
</th>
<td class="field_value " id="field_container_cf_last_closed" colspan="2">2021-05-26 17:32:13 UTC </td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td colspan="3">
<hr id="bz_top_half_spacer">
</td>
</tr>
</tbody>
</table>
<table id="bz_big_form_parts">
<tbody>
<tr>
<td>
<script type="text/javascript">
<!--
function toggle_display(link) {
var table = document.getElementById("attachment_table");
var view_all = document.getElementById("view_all");
var hide_obsolete_url_parameter = "&hide_obsolete=1";
// Store current height for scrolling later
var originalHeight = table.offsetHeight;
var rows = YAHOO.util.Dom.getElementsByClassName('bz_tr_obsolete', 'tr', table);
for (var i = 0; i < rows.length; i++) {
bz_toggleClass(rows[i], 'bz_default_hidden');
}
if (YAHOO.util.Dom.hasClass(rows[0], 'bz_default_hidden')) {
link.innerHTML = "Show Obsolete";
view_all.href = view_all.href + hide_obsolete_url_parameter
} else {
link.innerHTML = "Hide Obsolete";
view_all.href = view_all.href.replace(hide_obsolete_url_parameter, "");
}
var newHeight = table.offsetHeight;
// This scrolling makes the window appear to not move at all.
window.scrollBy(0, newHeight - originalHeight);
return false;
}
//
-->
</script>
<br>
<table id="attachment_table">
<tbody>
<tr id="a0">
<th align="left"> Attachments </th>
<th colspan="2" align="right">
<a href="page.cgi?id=terms-conditions.html">(Terms of Use)</a>
</th>
</tr>
<tr class="bz_attach_footer">
<td colspan="3">
<a href="attachment.cgi?bugid=1962836&action=enter">Add an attachment</a> (proposed patch, testcase, etc.)
</td>
</tr>
</tbody>
</table>
<br>
</td>
<td class="groups">
</td>
</tr>
</tbody>
</table>
<div id="comments">
<script type="text/javascript">
<!--
/* Adds the reply text to the 'comment' textarea */
function replyToComment(id, real_id, name) {
var prefix = "(In reply to " + name + " from comment #" + id + ")\n";
var replytext = "";
/* pre id="comment_name_N" */
var text_elem = document.getElementById('comment_text_' + id);
var text = getText(text_elem);
replytext = prefix + wrapReplyText(text);
/* <textarea id="comment"> */
var textarea = document.getElementById('comment');
if (textarea.value != replytext) {
textarea.value += replytext;
}
textarea.focus();
}
//
-->
</script>
<!-- This auto-sizes the comments and positions the collapse/expand links
to the right. -->
<table class="bz_comment_table">
<tbody>
<tr>
<td>
<div id="c0" class="bz_comment bz_first_comment
">
<div class="bz_first_comment_head">
<span class="bz_comment_number">
<a href="show_bug.cgi?id=1962836#c0">Description</a>
</span>
<span class="bz_comment_user">
<span class="vcard redhat_user"><span class="fn">Guilherme de Almeida Suckevicz</span>
</span>
</span>
<span class="bz_comment_user_images">
</span>
<span class="bz_comment_time"> 2021-05-20 16:36:53 UTC </span>
</div>
<pre class="bz_comment_text">It was discovered that the Caribou onscreen keyboard could be made to crash when given certain input values. An attacker could use this to bypass screen-locking applications that support using Caribou as an input mechanism.
Reference:
<a href="https://bugs.launchpad.net/ubuntu/+source/caribou/+bug/1912060">https://bugs.launchpad.net/ubuntu/+source/caribou/+bug/1912060</a>
</pre>
</div>
<div id="c1" class="bz_comment
">
<div class="bz_comment_head">
<span class="bz_comment_number">
<a href="show_bug.cgi?id=1962836#c1">Comment 1</a>
</span>
<span class="bz_comment_user">
<span class="vcard redhat_user"><span class="fn">Guilherme de Almeida Suckevicz</span>
</span>
</span>
<span class="bz_comment_user_images">
</span>
<span class="bz_comment_time"> 2021-05-20 16:37:15 UTC </span>
</div>
<pre class="bz_comment_text">Created caribou tracking bugs for this issue:
Affects: epel-7 [<a class="bz_bug_link
bz_status_CLOSED bz_closed
" title="CLOSED ERRATA - CVE-2021-3567 caribou: segfault on pressing ē since Xorg CVE-2020-25712 fix [epel-7]" href="show_bug.cgi?id=1962838">bug 1962838</a>]
Affects: fedora-all [<a class="bz_bug_link
bz_status_CLOSED bz_closed
" title="CLOSED NOTABUG - caribou: configurable on screen keyboard with scanning mode [fedora-all]" href="show_bug.cgi?id=1962837">bug 1962837</a>]
</pre>
</div>
<div id="c2" class="bz_comment
">
<div class="bz_comment_head">
<span class="bz_comment_number">
<a href="show_bug.cgi?id=1962836#c2">Comment 2</a>
</span>
<span class="bz_comment_user">
<span class="vcard redhat_user"><span class="fn">Mauro Matteo Cascella</span>
</span>
</span>
<span class="bz_comment_user_images">
</span>
<span class="bz_comment_time"> 2021-05-26 14:08:36 UTC </span>
</div>
<pre class="bz_comment_text">Upstream merge request:
<a href="https://gitlab.gnome.org/GNOME/caribou/-/merge_requests/3">https://gitlab.gnome.org/GNOME/caribou/-/merge_requests/3</a>
Upstream fix:
<a href="https://gitlab.gnome.org/GNOME/caribou/-/commit/d41c8e44b12222a290eaca16703406b113a630c6">https://gitlab.gnome.org/GNOME/caribou/-/commit/d41c8e44b12222a290eaca16703406b113a630c6</a>
</pre>
</div>
<div id="c3" class="bz_comment
">
<div class="bz_comment_head">
<span class="bz_comment_number">
<a href="show_bug.cgi?id=1962836#c3">Comment 3</a>
</span>
<span class="bz_comment_user">
<span class="vcard redhat_user"><span class="fn">Mauro Matteo Cascella</span>
</span>
</span>
<span class="bz_comment_user_images">
</span>
<span class="bz_comment_time"> 2021-05-26 14:13:05 UTC </span>
</div>
<pre class="bz_comment_text">Not strictly required from a security perspective, these are related issues/commits that have been ported upstream from Linux Mint:
<a href="https://gitlab.gnome.org/GNOME/caribou/-/issues/7">https://gitlab.gnome.org/GNOME/caribou/-/issues/7</a>
<a href="https://gitlab.gnome.org/GNOME/caribou/-/commit/76fbd11575f918fc898cb0f5defe07f67c11ec38">https://gitlab.gnome.org/GNOME/caribou/-/commit/76fbd11575f918fc898cb0f5defe07f67c11ec38</a>
<a href="https://gitlab.gnome.org/GNOME/caribou/-/merge_requests/5">https://gitlab.gnome.org/GNOME/caribou/-/merge_requests/5</a>
<a href="https://gitlab.gnome.org/GNOME/caribou/-/commit/ba8219ccc67d1d0964fb9ff25125c3be5fb80681">https://gitlab.gnome.org/GNOME/caribou/-/commit/ba8219ccc67d1d0964fb9ff25125c3be5fb80681</a>
</pre>
</div>
<div id="c4" class="bz_comment
">
<div class="bz_comment_head">
<span class="bz_comment_number">
<a href="show_bug.cgi?id=1962836#c4">Comment 4</a>
</span>
<span class="bz_comment_user">
<span class="vcard redhat_user"><span class="fn">Mauro Matteo Cascella</span>
</span>
</span>
<span class="bz_comment_user_images">
</span>
<span class="bz_comment_time"> 2021-05-26 14:51:35 UTC </span>
</div>
<pre class="bz_comment_text">In reply to <a href="show_bug.cgi?id=1962836#c0">comment #0</a>:
<span class="quote">> It was discovered that the Caribou onscreen keyboard could be made to crash
> when given certain input values. An attacker could use this to bypass
> screen-locking applications that support using Caribou as an input mechanism.</span>
Specifically, this was first reported in the on-screen keyboard which runs within the Cinnamon process and uses libcaribou. Pressing ē led to a Cinnamon crash and possible screensaver lock bypass.
Cinnamon issue:
<a href="https://github.com/linuxmint/cinnamon-screensaver/issues/354">https://github.com/linuxmint/cinnamon-screensaver/issues/354</a>
</pre>
</div>
<div id="c5" class="bz_comment
">
<div class="bz_comment_head">
<span class="bz_comment_number">
<a href="show_bug.cgi?id=1962836#c5">Comment 5</a>
</span>
<span class="bz_comment_user">
<span class="vcard redhat_user"><span class="fn">Mauro Matteo Cascella</span>
</span>
</span>
<span class="bz_comment_user_images">
</span>
<span class="bz_comment_time"> 2021-05-26 14:58:14 UTC </span>
</div>
<pre class="bz_comment_text">It is worth noting that caribou is only shipped with Red Hat Enterprise Linux 7 (caribou-0.4.21) while cinnamon-screensaver is not shipped in Red Hat products.
</pre>
</div>
<script>
$(document).ready(function() {
var mysel = document.getElementsByClassName('flag_type-415')[0];
var relnotes = document.getElementById('cf_release_notes');
if (mysel && relnotes && relnotes.value != '' && relnotes.value != cf_doc_type_text[document.getElementById('cf_doc_type').value] && mysel.options[mysel.selectedIndex].value != '+') document.getElementById('cf_doc_warn')
.innerHTML = '<div class="warning "><b>Warning: Doc Text is not yet verified as correct</b></div>';
});
</script>
</td>
<td>
</td>
</tr>
</tbody>
</table>
</div>
<hr>
<div id="add_comment" class="bz_section_additional_comments">
<table>
<tbody>
<tr>
<td>
<fieldset>
<legend>Note</legend> You need to <a href="show_bug.cgi?id=1962836&GoAheadAndLogIn=1">log in</a> before you can comment on or make changes to this bug.
</fieldset>
</td>
</tr>
</tbody>
</table>
</div>
</form>GET buglist.cgi
<form action="buglist.cgi" method="get" onsubmit="if (this.quicksearch.value == '')
{ alert('Please enter one or more search terms first.');
return false; } return true;">
<input type="hidden" id="no_redirect_bottom" name="no_redirect" value="1">
<script type="text/javascript">
if (history && history.replaceState) {
var no_redirect = document.getElementById("no_redirect_bottom");
no_redirect.value = 1;
}
</script>
<input class="txt" type="text" id="quicksearch_bottom" name="quicksearch" title="Quick Search" value="">
<input class="btn" type="submit" value="Search" id="find_bottom">
</form>Text Content
Login
[x]
* Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
* Forgot Password
Login:
Hide Forgot
* Create an Account
Red Hat Bugzilla – Bug 1962836
*
[?]
*
* New
* * Simple Search
* Advanced Search
* My Links
* Browse
* Requests
* Reports
* Current State
* Search
* Tabular reports
* Graphical reports
* Duplicates
* Other Reports
* User Changes
* Plotly Reports
* Bug Status
* Bug Severity
* Non-Defaults
* | Product Dashboard
* Help
* Page Help!
* Bug Writing Guidelines
* What's new
* Browser Support Policy
* 5.0.4.rh68 Release notes
* FAQ
* Guides index
* User guide
* Web Services
* Contact
* Legal
Note: If your use of the APIs is failing with an error titled 'API access must
use the Authorization header' then you need to read the API Authentication
changes announcement
This site requires JavaScript to be enabled to function correctly, please enable
it.
*
*
*
*
*
*
Bug 1962836 (CVE-2021-3567) - CVE-2021-3567 caribou: segfault on pressing ē
since Xorg CVE-2020-25712 fix
Summary: CVE-2021-3567 caribou: segfault on pressing ē since Xorg CVE-2020-25712
fix
Keywords:
Security
Security ×
Status: CLOSED WONTFIX Alias: CVE-2021-3567 Product: Security Response
Classification: Other Component: vulnerability Sub Component:
Version: unspecified Hardware: All OS: Linux Priority: medium Severity: medium
Target Milestone: --- Assignee: Red Hat Product Security QA Contact: Docs
Contact: URL: Whiteboard: Depends On: 1962837 1962838 Blocks: 1962839 1965598
TreeView+ depends on / blocked
Reported: 2021-05-20 16:36 UTC by Guilherme de Almeida Suckevicz Modified:
2022-03-25 08:35 UTC (History) CC List: 4 users (show)
dueno jcpunk leigh123linux pnemade
Fixed In Version: caribou 0.4.21 Doc Type: If docs needed, set a value Doc Text:
A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An
attacker could use this flaw to bypass screen-locking applications that leverage
Caribou as an input mechanism. The highest threat from this vulnerability is to
system availability.
Clone Of: Environment:
Last Closed: 2021-05-26 17:32:13 UTC
--------------------------------------------------------------------------------
Attachments (Terms of Use) Add an attachment (proposed patch, testcase, etc.)
Description Guilherme de Almeida Suckevicz 2021-05-20 16:36:53 UTC
It was discovered that the Caribou onscreen keyboard could be made to crash when given certain input values. An attacker could use this to bypass screen-locking applications that support using Caribou as an input mechanism.
Reference:
https://bugs.launchpad.net/ubuntu/+source/caribou/+bug/1912060
Comment 1 Guilherme de Almeida Suckevicz 2021-05-20 16:37:15 UTC
Created caribou tracking bugs for this issue:
Affects: epel-7 [bug 1962838]
Affects: fedora-all [bug 1962837]
Comment 2 Mauro Matteo Cascella 2021-05-26 14:08:36 UTC
Upstream merge request:
https://gitlab.gnome.org/GNOME/caribou/-/merge_requests/3
Upstream fix:
https://gitlab.gnome.org/GNOME/caribou/-/commit/d41c8e44b12222a290eaca16703406b113a630c6
Comment 3 Mauro Matteo Cascella 2021-05-26 14:13:05 UTC
Not strictly required from a security perspective, these are related issues/commits that have been ported upstream from Linux Mint:
https://gitlab.gnome.org/GNOME/caribou/-/issues/7
https://gitlab.gnome.org/GNOME/caribou/-/commit/76fbd11575f918fc898cb0f5defe07f67c11ec38
https://gitlab.gnome.org/GNOME/caribou/-/merge_requests/5
https://gitlab.gnome.org/GNOME/caribou/-/commit/ba8219ccc67d1d0964fb9ff25125c3be5fb80681
Comment 4 Mauro Matteo Cascella 2021-05-26 14:51:35 UTC
In reply to comment #0:
> It was discovered that the Caribou onscreen keyboard could be made to crash
> when given certain input values. An attacker could use this to bypass
> screen-locking applications that support using Caribou as an input mechanism.
Specifically, this was first reported in the on-screen keyboard which runs within the Cinnamon process and uses libcaribou. Pressing ē led to a Cinnamon crash and possible screensaver lock bypass.
Cinnamon issue:
https://github.com/linuxmint/cinnamon-screensaver/issues/354
Comment 5 Mauro Matteo Cascella 2021-05-26 14:58:14 UTC
It is worth noting that caribou is only shipped with Red Hat Enterprise Linux 7 (caribou-0.4.21) while cinnamon-screensaver is not shipped in Red Hat products.
--------------------------------------------------------------------------------
Note You need to log in before you can comment on or make changes to this bug.
--------------------------------------------------------------------------------
*
*
*
*
*
*
* *
[?]
Type a sub-component name