CVE-2019-14822

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	ibus	ibus versions before 1.5.22

References

https://bugzilla.redhat.com/show_bug.cgi?id=1717958Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14822Issue Tracking, Patch, Third Party Advisory
https://usn.ubuntu.com/4134-3/Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1717958Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14822Issue Tracking, Patch, Third Party Advisory
https://usn.ubuntu.com/4134-3/Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Timeline

Published: Nov 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148237.4A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it impli CVE-2019-148246.5A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some config CVE-2019-148252.7A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during con CVE-2019-148264.4A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this CVE-2019-148276.1A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts CVE-2019-148284.3A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with th CVE-2019-148294.3A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creat CVE-2019-14837.8An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerab CVE-2019-148306.1A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpo CVE-2019-148316.1A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link co CVE-2019-148327.5A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. A CVE-2019-148335.4A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user