In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
1.0.1-1ubuntu11.1.0-1ubuntu11.1.0-1ubuntu21.1.3-1ubuntu11.1.4-1ubuntu11.1.4-1ubuntu21.2.2-1ubuntu11.2.3-1ubuntu11.6.3-1ubuntu1~16.04.11.10.0-11.10.1-11.10.3-21.10.4-11.10.4-1ubuntu0.18.04.11.10.4-1ubuntu0.18.04.21.10.4-1ubuntu0.18.04.31.8.2-1ubuntu21.9.2-11.9.3-1+3 more1.14.1-21.14.2-11.14.3-11.14.3-1build11.15.1-11.15.2-11.15.3-11.15.4-11.15.5-11.15.5-1ubuntu0.1+2 more1.18.1-11.19.2-11.19.3-11.19.3-21.20.0-11.20.0-1ubuntu0.11.20.0-1ubuntu0.21.20.0-1ubuntu0.31.23.0-21.23.0-2.11.25.0-11.25.0-1ubuntu11.25.0-1ubuntu21.25.0-1ubuntu31.25.0-1ubuntu3.11.25.0-1ubuntu3.21.25.0-1ubuntu3.31.25.0-1ubuntu3.41.27.1-11.28.1-11.28.1-1build11.28.1-1ubuntu0.11.28.1-1ubuntu0.21.28.1-1ubuntu0.31.28.1-1build11.28.1-1ubuntu21.30.0-11.30.1-11.31.0-11.31.0-1ubuntu0.11.31.1-1