CVE catalog

CVE-2021-3567

caribou: CVE-2021-3567

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.16% · Oct 25, 2026

A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen-locking applications that leverage Caribou as an input mechanism. The highest threat from this vulnerability is to system availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancaribousid0.4.21-11fixed
Debiancaribouforky0.4.21-11fixed
Debiancariboutrixie0.4.21-10fixed
Debiancariboubookworm0.4.21-8fixed
Ubuntucaribou16.040.4.18.1-1vulnerable
Ubuntucaribou16.040.4.19-1vulnerable
Ubuntucaribou16.040.4.20-1vulnerable
Ubuntucaribou18.040.4.21-2vulnerable
Ubuntucaribou18.040.4.21-3vulnerable
Ubuntucaribou18.040.4.21-4vulnerable
Ubuntucaribou18.040.4.21-5vulnerable
Susecariboulinux enterprise module for desktop applications 15 sp20.4.21-12.5.1fixed
Susecariboulinux enterprise module for desktop applications 15 sp30.4.21-12.5.1fixed
Susecariboulinux enterprise high performance computing 15-espos0.4.21-5.3.1fixed
Susecariboulinux enterprise high performance computing 15-ltss0.4.21-5.3.1fixed
Susecariboulinux enterprise high performance computing 15 sp1-espos0.4.21-5.3.1fixed
Susecariboulinux enterprise high performance computing 15 sp1-ltss0.4.21-5.3.1fixed
Susecariboulinux enterprise server 15-ltss0.4.21-5.3.1fixed
Susecariboulinux enterprise server 15 sp1-bcl0.4.21-5.3.1fixed
Susecariboulinux enterprise server 15 sp1-ltss0.4.21-5.3.1fixed
Susecariboulinux enterprise server for sap applications 150.4.21-5.3.1fixed
Susecariboulinux enterprise server for sap applications 15 sp10.4.21-5.3.1fixed
Susecariboumanager proxy 4.00.4.21-5.3.1fixed
Susecariboumanager retail branch server 4.00.4.21-5.3.1fixed
Susecariboumanager server 4.00.4.21-5.3.1fixed
Susecaribouenterprise storage 60.4.21-5.3.1fixed
Opensusecaribouleap 15.30.4.21-12.5.1fixed
Susecaribouhpe helion openstack 80.4.21-8.3.1fixed
Susecaribouopenstack cloud 80.4.21-8.3.1fixed
Susecaribouopenstack cloud 90.4.21-8.3.1fixed
Susecaribouopenstack cloud crowbar 80.4.21-8.3.1fixed
Susecaribouopenstack cloud crowbar 90.4.21-8.3.1fixed
Susecariboulinux enterprise server for sap applications 12 sp30.4.21-8.3.1fixed
Susecariboulinux enterprise server for sap applications 12 sp40.4.21-8.3.1fixed
Susecariboulinux enterprise software development kit 12 sp50.4.21-8.3.1fixed
Susecariboulinux enterprise server 12 sp2-bcl0.4.21-8.3.1fixed
Susecariboulinux enterprise server 12 sp3-ltss0.4.21-8.3.1fixed
Susecariboulinux enterprise server 12 sp3-bcl0.4.21-8.3.1fixed
Susecariboulinux enterprise server 12 sp4-ltss0.4.21-8.3.1fixed
Susecariboulinux enterprise server 12 sp50.4.21-8.3.1fixed
Susecariboulinux enterprise server for sap applications 12 sp50.4.21-8.3.1fixed
Susecariboulinux enterprise workstation extension 12 sp50.4.21-8.3.1fixed
Opensusecaribouleap 15.20.4.21-lp152.7.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancaribousourcesid0.4.21-7.1not yet assignedNot reported[980061]
Debiancaribousourceforky0.4.21-7.1not yet assignedNot reported[980061]
Debiancaribousourcetrixie0.4.21-7.1not yet assignedNot reported[980061]
Debiancaribousourcebookworm0.4.21-7.1not yet assignedNot reported[980061]
Susecaribourpmlinux enterprise module for desktop applications 15 sp20.4.21-12.5.1Not reportedSUSE-SU-2021:2414-1Not reported
Susecaribourpmlinux enterprise module for desktop applications 15 sp30.4.21-12.5.1Not reportedSUSE-SU-2021:2414-1Not reported
Susecaribourpmlinux enterprise high performance computing 15-espos0.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise high performance computing 15-ltss0.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise high performance computing 15 sp1-espos0.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise high performance computing 15 sp1-ltss0.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise server 15-ltss0.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise server 15 sp1-bcl0.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise server 15 sp1-ltss0.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise server for sap applications 150.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmlinux enterprise server for sap applications 15 sp10.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmmanager proxy 4.00.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmmanager retail branch server 4.00.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmmanager server 4.00.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Susecaribourpmenterprise storage 60.4.21-5.3.1Not reportedSUSE-SU-2021:2007-1Not reported
Opensusecaribourpmleap 15.30.4.21-12.5.1Not reportedOPENSUSE-SU-2021:2414-1Not reported
Susecaribourpmhpe helion openstack 80.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmopenstack cloud 80.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmopenstack cloud 90.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmopenstack cloud crowbar 80.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmopenstack cloud crowbar 90.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server for sap applications 12 sp30.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server for sap applications 12 sp40.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise software development kit 12 sp50.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server 12 sp2-bcl0.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server 12 sp3-ltss0.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server 12 sp3-bcl0.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server 12 sp4-ltss0.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server 12 sp50.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise server for sap applications 12 sp50.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Susecaribourpmlinux enterprise workstation extension 12 sp50.4.21-8.3.1Not reportedSUSE-SU-2021:1943-1Not reported
Opensusecaribourpmleap 15.20.4.21-lp152.7.3.1Not reportedOPENSUSE-SU-2021:1071-1Not reported

[Debian bug #980061]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [caribou]Fixed
    Details (2)

    • 0.4.21-8 · amd64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · arm64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

  • [caribou-antler]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-8 · all · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · all · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

  • [gir1.2-caribou-1.0]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-8 · amd64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · arm64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

  • [libcaribou0]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-8 · amd64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · arm64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

  • [libcaribou-common]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-8 · all · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · all · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

  • [libcaribou-dev]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-8 · amd64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · arm64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

  • [libcaribou-gtk3-module]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-8 · amd64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · arm64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

  • [libcaribou-gtk-module]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-8 · amd64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

    • 0.4.21-8 · arm64 · bookworm

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · bookworm; dsa · caribou · debian · 12

[Debian 13 (Trixie)]

  • [caribou]Fixed
    Details (2)

    • 0.4.21-10 · amd64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · arm64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

  • [caribou-antler]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-10 · all · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · all · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

  • [gir1.2-caribou-1.0]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-10 · amd64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · arm64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

  • [libcaribou0]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-10 · amd64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · arm64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

  • [libcaribou-common]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-10 · all · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · all · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

  • [libcaribou-dev]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-10 · amd64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · arm64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

  • [libcaribou-gtk3-module]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-10 · amd64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · arm64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

  • [libcaribou-gtk-module]Fixed

    Source package: [caribou]

    Details (2)

    • 0.4.21-10 · amd64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

    • 0.4.21-10 · arm64 · trixie

      Fixed · Fixed: 0.4.21-7.1

      dsa · caribou · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]