7.1

CVE-2019-14822: canonical ubuntu_linux Missing Authorization

CVSS: 7.1v3.1HighModified
AliasesMGASA-2019-0284SUSE-SU-2019:2387-1SUSE-SU-2019:2388-1
Published 25-11-2019Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2019-14822 is a high (CVSS 7.1) Missing Authorization vulnerability in canonical ubuntu_linux. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.9% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (NVD)
EPSS score
0.36%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
RHSA-2020:3978USN-4134-2

Timeline

  1. 25-11-2019
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.

CVSS metrics

5 scores · 4 sources · 3 versions

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

0.00 pp

From 0.36% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat27 products
  • enterprise_linuxEOL7.0 | 8.0
  • glib2< 0:2.56.4-8.el8
  • glib2-debuginfo< 0:2.56.4-8.el8
  • glib2-debugsource< 0:2.56.4-8.el8
  • glib2-devel< 0:2.56.4-8.el8
Suse25 products
  • ibus&distro=HPE Helion OpenStack 8< 1.5.13-15.11.2
  • ibus&distro=SUSE Enterprise Storage 4< 1.5.13-15.11.2
  • ibus&distro=SUSE Enterprise Storage 5< 1.5.13-15.11.2
  • ibus&distro=SUSE Linux Enterprise Desktop 12 SP4< 1.5.13-15.11.2
  • ibus&distro=SUSE Linux Enterprise Module for Desktop Applications 15< 1.5.17-5.3.1
Opensuse5 products
  • ibus&distro=openSUSE Leap 15.0< 1.5.17-lp150.4.3.1
  • ibus&distro=openSUSE Leap 15.1< 1.5.19-lp151.2.3.1
  • ibus&distro=openSUSE Tumbleweed< 1.5.25-1.2
  • python-ibus&distro=openSUSE Leap 15.1< 1.5.19-lp151.2.3.1
  • python3-ibus&distro=openSUSE Leap 15.0< 1.5.17-lp150.4.3.1
Mageia2 products
  • ibus< 1.5.16-3.1.mga6
  • ibus< 1.5.20-1.1.mga7
Canonical1 product
Debian1 product
  • ibus< 1.5.21-1 | < 1.5.14-3+deb9u2 | < 1.5.19-4+deb10u1
Ibus_project1 product
Oracle1 product
Ubuntu1 product
  • ibus< 1.5.11-1ubuntu2.2 | < 1.5.17-3ubuntu5.1 | < 1.5.11-1ubuntu2.4 | < 1.5.17-3ubuntu5.3

9 vendors · 64 products

References

28 links
Show all 28 references