Vulnerabilities > CVE-2018-15856 - Infinite Loop vulnerability in multiple products

047910
CVSS 2.1 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
local
low complexity
xkbcommon
canonical
CWE-835
nessus

Summary

An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-1418.NASL
    descriptionThis update for libxkbcommon to version 0.8.2 fixes the following issues : - Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. - CVE-2018-15853: Endless recursion could have been used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation (bsc#1105832). - CVE-2018-15854: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly (bsc#1105832). - CVE-2018-15855: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled (bsc#1105832). - CVE-2018-15856: An infinite loop when reaching EOL unexpectedly could be used by local attackers to cause a denial of service during parsing of crafted keymap files (bsc#1105832). - CVE-2018-15857: An invalid free in ExprAppendMultiKeysymList could have been used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file (bsc#1105832). - CVE-2018-15858: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file (bsc#1105832). - CVE-2018-15859: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled (bsc#1105832). - CVE-2018-15861: Unchecked NULL pointer usage in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure (bsc#1105832). - CVE-2018-15862: Unchecked NULL pointer usage in LookupModMask could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers (bsc#1105832). - CVE-2018-15863: Unchecked NULL pointer usage in ResolveStateAndPredicate could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression (bsc#1105832). - CVE-2018-15864: Unchecked NULL pointer usage in resolve_keysym could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created (bsc#1105832). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-05
    modified2018-11-19
    plugin id119023
    published2018-11-19
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119023
    titleopenSUSE Security Update : libxkbcommon (openSUSE-2018-1418)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2018-1418.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119023);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2018-15853", "CVE-2018-15854", "CVE-2018-15855", "CVE-2018-15856", "CVE-2018-15857", "CVE-2018-15858", "CVE-2018-15859", "CVE-2018-15861", "CVE-2018-15862", "CVE-2018-15863", "CVE-2018-15864");
    
      script_name(english:"openSUSE Security Update : libxkbcommon (openSUSE-2018-1418)");
      script_summary(english:"Check for the openSUSE-2018-1418 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for libxkbcommon to version 0.8.2 fixes the following
    issues :
    
      - Fix a few NULL-dereferences, out-of-bounds access and
        undefined behavior in the XKB text format parser.
    
      - CVE-2018-15853: Endless recursion could have been used
        by local attackers to crash xkbcommon users by supplying
        a crafted keymap file that triggers boolean negation
        (bsc#1105832).
    
      - CVE-2018-15854: Unchecked NULL pointer usage could have
        been used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file, because geometry tokens were desupported
        incorrectly (bsc#1105832).
    
      - CVE-2018-15855: Unchecked NULL pointer usage could have
        been used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file, because the XkbFile for an xkb_geometry
        section was mishandled (bsc#1105832).
    
      - CVE-2018-15856: An infinite loop when reaching EOL
        unexpectedly could be used by local attackers to cause a
        denial of service during parsing of crafted keymap files
        (bsc#1105832).
    
      - CVE-2018-15857: An invalid free in
        ExprAppendMultiKeysymList could have been used by local
        attackers to crash xkbcommon keymap parsers or possibly
        have unspecified other impact by supplying a crafted
        keymap file (bsc#1105832).
    
      - CVE-2018-15858: Unchecked NULL pointer usage when
        handling invalid aliases in CopyKeyAliasesToKeymap could
        have been used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file (bsc#1105832).
    
      - CVE-2018-15859: Unchecked NULL pointer usage when
        parsing invalid atoms in ExprResolveLhs could have been
        used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file, because lookup failures are mishandled
        (bsc#1105832).
    
      - CVE-2018-15861: Unchecked NULL pointer usage in
        ExprResolveLhs could have been used by local attackers
        to crash (NULL pointer dereference) the xkbcommon parser
        by supplying a crafted keymap file that triggers an
        xkb_intern_atom failure (bsc#1105832).
    
      - CVE-2018-15862: Unchecked NULL pointer usage in
        LookupModMask could have been used by local attackers to
        crash (NULL pointer dereference) the xkbcommon parser by
        supplying a crafted keymap file with invalid virtual
        modifiers (bsc#1105832).
    
      - CVE-2018-15863: Unchecked NULL pointer usage in
        ResolveStateAndPredicate could have been used by local
        attackers to crash (NULL pointer dereference) the
        xkbcommon parser by supplying a crafted keymap file with
        a no-op modmask expression (bsc#1105832).
    
      - CVE-2018-15864: Unchecked NULL pointer usage in
        resolve_keysym could have been used by local attackers
        to crash (NULL pointer dereference) the xkbcommon parser
        by supplying a crafted keymap file, because a map access
        attempt can occur for a map that was never created
        (bsc#1105832).
    
    This update was imported from the SUSE:SLE-15:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1105832"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libxkbcommon packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/11/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-debugsource-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-devel-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-x11-0-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-x11-0-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-x11-devel-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon0-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon0-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-devel-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-x11-0-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-x11-0-32bit-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-x11-devel-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon0-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon0-32bit-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxkbcommon-debugsource / libxkbcommon-devel / libxkbcommon-x11-0 / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-913.NASL
    descriptionThis update for libxkbcommon to version 0.8.2 fixes the following issues : - Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. - CVE-2018-15853: Endless recursion could have been used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation (bsc#1105832). - CVE-2018-15854: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly (bsc#1105832). - CVE-2018-15855: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled (bsc#1105832). - CVE-2018-15856: An infinite loop when reaching EOL unexpectedly could be used by local attackers to cause a denial of service during parsing of crafted keymap files (bsc#1105832). - CVE-2018-15857: An invalid free in ExprAppendMultiKeysymList could have been used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file (bsc#1105832). - CVE-2018-15858: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file (bsc#1105832). - CVE-2018-15859: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled (bsc#1105832). - CVE-2018-15861: Unchecked NULL pointer usage in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure (bsc#1105832). - CVE-2018-15862: Unchecked NULL pointer usage in LookupModMask could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers (bsc#1105832). - CVE-2018-15863: Unchecked NULL pointer usage in ResolveStateAndPredicate could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression (bsc#1105832). - CVE-2018-15864: Unchecked NULL pointer usage in resolve_keysym could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created (bsc#1105832). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id123373
    published2019-03-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123373
    titleopenSUSE Security Update : libxkbcommon (openSUSE-2019-913)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2019-913.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(123373);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/27");
    
      script_cve_id("CVE-2018-15853", "CVE-2018-15854", "CVE-2018-15855", "CVE-2018-15856", "CVE-2018-15857", "CVE-2018-15858", "CVE-2018-15859", "CVE-2018-15861", "CVE-2018-15862", "CVE-2018-15863", "CVE-2018-15864");
    
      script_name(english:"openSUSE Security Update : libxkbcommon (openSUSE-2019-913)");
      script_summary(english:"Check for the openSUSE-2019-913 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for libxkbcommon to version 0.8.2 fixes the following
    issues :
    
      - Fix a few NULL-dereferences, out-of-bounds access and
        undefined behavior in the XKB text format parser.
    
      - CVE-2018-15853: Endless recursion could have been used
        by local attackers to crash xkbcommon users by supplying
        a crafted keymap file that triggers boolean negation
        (bsc#1105832).
    
      - CVE-2018-15854: Unchecked NULL pointer usage could have
        been used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file, because geometry tokens were desupported
        incorrectly (bsc#1105832).
    
      - CVE-2018-15855: Unchecked NULL pointer usage could have
        been used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file, because the XkbFile for an xkb_geometry
        section was mishandled (bsc#1105832).
    
      - CVE-2018-15856: An infinite loop when reaching EOL
        unexpectedly could be used by local attackers to cause a
        denial of service during parsing of crafted keymap files
        (bsc#1105832).
    
      - CVE-2018-15857: An invalid free in
        ExprAppendMultiKeysymList could have been used by local
        attackers to crash xkbcommon keymap parsers or possibly
        have unspecified other impact by supplying a crafted
        keymap file (bsc#1105832).
    
      - CVE-2018-15858: Unchecked NULL pointer usage when
        handling invalid aliases in CopyKeyAliasesToKeymap could
        have been used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file (bsc#1105832).
    
      - CVE-2018-15859: Unchecked NULL pointer usage when
        parsing invalid atoms in ExprResolveLhs could have been
        used by local attackers to crash (NULL pointer
        dereference) the xkbcommon parser by supplying a crafted
        keymap file, because lookup failures are mishandled
        (bsc#1105832).
    
      - CVE-2018-15861: Unchecked NULL pointer usage in
        ExprResolveLhs could have been used by local attackers
        to crash (NULL pointer dereference) the xkbcommon parser
        by supplying a crafted keymap file that triggers an
        xkb_intern_atom failure (bsc#1105832).
    
      - CVE-2018-15862: Unchecked NULL pointer usage in
        LookupModMask could have been used by local attackers to
        crash (NULL pointer dereference) the xkbcommon parser by
        supplying a crafted keymap file with invalid virtual
        modifiers (bsc#1105832).
    
      - CVE-2018-15863: Unchecked NULL pointer usage in
        ResolveStateAndPredicate could have been used by local
        attackers to crash (NULL pointer dereference) the
        xkbcommon parser by supplying a crafted keymap file with
        a no-op modmask expression (bsc#1105832).
    
      - CVE-2018-15864: Unchecked NULL pointer usage in
        resolve_keysym could have been used by local attackers
        to crash (NULL pointer dereference) the xkbcommon parser
        by supplying a crafted keymap file, because a map access
        attempt can occur for a map that was never created
        (bsc#1105832).
    
    This update was imported from the SUSE:SLE-15:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1105832"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libxkbcommon packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon-x11-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxkbcommon0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/25");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/03/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/03/27");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-debugsource-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-devel-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-x11-0-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-x11-0-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon-x11-devel-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon0-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libxkbcommon0-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-devel-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-x11-0-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-x11-0-32bit-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon-x11-devel-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon0-32bit-0.8.2-lp150.2.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libxkbcommon0-32bit-debuginfo-0.8.2-lp150.2.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxkbcommon-debugsource / libxkbcommon-devel / etc");
    }
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2020-1433.NASL
    descriptionIt was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a malicious X server or modify the data coming from one, could use this flaw to crash the application using libX11, resulting in a denial of service.(CVE-2018-14598) An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts(). An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption.(CVE-2018-14599) An out of bounds write, limited to NULL bytes, was discovered in libX11 in functions XListExtensions() and XGetFontPath(). The length field is considered as a signed value, which makes the library access memory before the intended buffer. An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption.(CVE-2018-14600) An uncontrolled recursion flaw was found in libxkbcommon in the way it parses boolean expressions. A specially crafted file provided to xkbcomp could crash the application. (CVE-2018-15853) Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly. (CVE-2018-15854) Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled. (CVE-2018-15855) An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files. (CVE-2018-15856) An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file. (CVE-2018-15857) Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859) Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure. (CVE-2018-15861) Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers. (CVE-2018-15862) Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression. (CVE-2018-15863) Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)
    last seen2020-06-10
    modified2020-06-04
    plugin id137090
    published2020-06-04
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137090
    titleAmazon Linux 2 : xorg-x11-server (ALAS-2020-1433)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux 2 Security Advisory ALAS-2020-1433.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(137090);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/09");
    
      script_cve_id("CVE-2018-14598", "CVE-2018-14599", "CVE-2018-14600", "CVE-2018-15853", "CVE-2018-15854", "CVE-2018-15855", "CVE-2018-15856", "CVE-2018-15857", "CVE-2018-15859", "CVE-2018-15861", "CVE-2018-15862", "CVE-2018-15863", "CVE-2018-15864");
      script_xref(name:"ALAS", value:"2020-1433");
    
      script_name(english:"Amazon Linux 2 : xorg-x11-server (ALAS-2020-1433)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Amazon Linux 2 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "It was discovered that libX11 does not properly validate input coming
    from the server, causing XListExtensions() and XGetFontPath()
    functions to produce an invalid list of elements that in turn make
    XFreeExtensionsList() and XFreeFontPath() access invalid memory. An
    attacker who can either configure a malicious X server or modify the
    data coming from one, could use this flaw to crash the application
    using libX11, resulting in a denial of service.(CVE-2018-14598)
    
    An off-by-one error has been discovered in libX11 in functions
    XGetFontPath(), XListExtensions(), and XListFonts(). An attacker who
    can either configure a malicious X server or modify the data coming
    from one could use this flaw to make the program crash or have other
    unspecified effects, caused by the memory corruption.(CVE-2018-14599)
    
    An out of bounds write, limited to NULL bytes, was discovered in
    libX11 in functions XListExtensions() and XGetFontPath(). The length
    field is considered as a signed value, which makes the library access
    memory before the intended buffer. An attacker who can either
    configure a malicious X server or modify the data coming from one
    could use this flaw to make the program crash or have other
    unspecified effects, caused by the memory corruption.(CVE-2018-14600)
    
    An uncontrolled recursion flaw was found in libxkbcommon in the way it
    parses boolean expressions. A specially crafted file provided to
    xkbcomp could crash the application. (CVE-2018-15853)
    
    Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used
    by local attackers to crash (NULL pointer dereference) the xkbcommon
    parser by supplying a crafted keymap file, because geometry tokens
    were desupported incorrectly. (CVE-2018-15854)
    
    Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used
    by local attackers to crash (NULL pointer dereference) the xkbcommon
    parser by supplying a crafted keymap file, because the XkbFile for an
    xkb_geometry section was mishandled. (CVE-2018-15855)
    
    An infinite loop when reaching EOL unexpectedly in compose/parser.c
    (aka the keymap parser) in xkbcommon before 0.8.1 could be used by
    local attackers to cause a denial of service during parsing of crafted
    keymap files. (CVE-2018-15856)
    
    An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in
    xkbcommon before 0.8.1 could be used by local attackers to crash
    xkbcommon keymap parsers or possibly have unspecified other impact by
    supplying a crafted keymap file. (CVE-2018-15857)
    
    Unchecked NULL pointer usage when parsing invalid atoms in
    ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be
    used by local attackers to crash (NULL pointer dereference) the
    xkbcommon parser by supplying a crafted keymap file, because lookup
    failures are mishandled. (CVE-2018-15859)
    
    Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in
    xkbcommon before 0.8.2 could be used by local attackers to crash (NULL
    pointer dereference) the xkbcommon parser by supplying a crafted
    keymap file that triggers an xkb_intern_atom failure. (CVE-2018-15861)
    
    Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in
    xkbcommon before 0.8.2 could be used by local attackers to crash (NULL
    pointer dereference) the xkbcommon parser by supplying a crafted
    keymap file with invalid virtual modifiers. (CVE-2018-15862)
    
    Unchecked NULL pointer usage in ResolveStateAndPredicate in
    xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local
    attackers to crash (NULL pointer dereference) the xkbcommon parser by
    supplying a crafted keymap file with a no-op modmask expression.
    (CVE-2018-15863)
    
    Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in
    xkbcommon before 0.8.2 could be used by local attackers to crash (NULL
    pointer dereference) the xkbcommon parser by supplying a crafted
    keymap file, because a map access attempt can occur for a map that was
    never created. (CVE-2018-15864)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/AL2/ALAS-2020-1433.html"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Run 'yum update xorg-x11-server' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xdmx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xephyr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xnest");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xorg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xvfb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xwayland");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-source");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/06/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/04");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "2")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xdmx-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xephyr-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xnest-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xorg-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xvfb-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xwayland-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-common-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-debuginfo-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-devel-1.20.4-7.amzn2.0.1")) flag++;
    if (rpm_check(release:"AL2", reference:"xorg-x11-server-source-1.20.4-7.amzn2.0.1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xorg-x11-server-Xdmx / xorg-x11-server-Xephyr / etc");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3786-1.NASL
    descriptionIt was discovered that libxkbcommon incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id117996
    published2018-10-09
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117996
    titleUbuntu 14.04 LTS / 16.04 LTS : libxkbcommon vulnerabilities (USN-3786-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201810-05.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201810-05 (xkbcommon: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libxkbcommon. Please review the CVE identifiers referenced below for details. Impact : A local attacker could supply a specially crafted keymap file possibly resulting in a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id118505
    published2018-10-31
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118505
    titleGLSA-201810-05 : xkbcommon: Multiple vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2079.NASL
    descriptionAn update for Xorg is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es) : * libX11: Crash on invalid reply in XListExtensions in ListExt.c (CVE-2018-14598) * libX11: Off-by-one error in XListExtensions in ListExt.c (CVE-2018-14599) * libX11: Out of Bounds write in XListExtensions in ListExt.c (CVE-2018-14600) * libxkbcommon: Invalid free in ExprAppendMultiKeysymList resulting in a crash (CVE-2018-15857) * libxkbcommon: Endless recursion in xkbcomp/expr.c resulting in a crash (CVE-2018-15853) * libxkbcommon: NULL pointer dereference resulting in a crash (CVE-2018-15854) * libxkbcommon: NULL pointer dereference when handling xkb_geometry (CVE-2018-15855) * libxkbcommon: Infinite loop when reaching EOL unexpectedly resulting in a crash (CVE-2018-15856) * libxkbcommon: NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash (CVE-2018-15859) * libxkbcommon: NULL pointer dereference in ExprResolveLhs resulting in a crash (CVE-2018-15861) * libxkbcommon: NULL pointer dereference in LookupModMask resulting in a crash (CVE-2018-15862) * libxkbcommon: NULL pointer dereference in ResolveStateAndPredicate resulting in a crash (CVE-2018-15863) * libxkbcommon: NULL pointer dereference in resolve_keysym resulting in a crash (CVE-2018-15864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id128349
    published2019-08-30
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128349
    titleCentOS 7 : gdm / libX11 / libxkbcommon / xorg-x11-drv-ati / xorg-x11-drv-vesa / etc (CESA-2019:2079)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190806_XORG_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - libX11: Crash on invalid reply in XListExtensions in ListExt.c (CVE-2018-14598) - libX11: Off-by-one error in XListExtensions in ListExt.c (CVE-2018-14599) - libX11: Out of Bounds write in XListExtensions in ListExt.c (CVE-2018-14600) - libxkbcommon: Invalid free in ExprAppendMultiKeysymList resulting in a crash (CVE-2018-15857) - libxkbcommon: Endless recursion in xkbcomp/expr.c resulting in a crash (CVE-2018-15853) - libxkbcommon: NULL pointer dereference resulting in a crash (CVE-2018-15854) - libxkbcommon: NULL pointer dereference when handling xkb_geometry (CVE-2018-15855) - libxkbcommon: Infinite loop when reaching EOL unexpectedly resulting in a crash (CVE-2018-15856) - libxkbcommon: NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash (CVE-2018-15859) - libxkbcommon: NULL pointer dereference in ExprResolveLhs resulting in a crash (CVE-2018-15861) - libxkbcommon: NULL pointer dereference in LookupModMask resulting in a crash (CVE-2018-15862) - libxkbcommon: NULL pointer dereference in ResolveStateAndPredicate resulting in a crash (CVE-2018-15863) - libxkbcommon: NULL pointer dereference in resolve_keysym resulting in a crash (CVE-2018-15864)
    last seen2020-03-18
    modified2019-08-27
    plugin id128206
    published2019-08-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128206
    titleScientific Linux Security Update : Xorg on SL7.x x86_64 (20190806)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0246_LIBXKBCOMMON.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libxkbcommon packages installed that are affected by multiple vulnerabilities: - Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers. (CVE-2018-15862) - Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression. (CVE-2018-15863) - Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864) - Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation. (CVE-2018-15853) - Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859) - Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure. (CVE-2018-15861) - An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file. (CVE-2018-15857) - An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files. (CVE-2018-15856) - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled. (CVE-2018-15855) - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly. (CVE-2018-15854) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id132511
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132511
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : libxkbcommon Multiple Vulnerabilities (NS-SA-2019-0246)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3685-1.NASL
    descriptionThis update for libxkbcommon to version 0.8.2 fixes the following issues : Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. CVE-2018-15853: Endless recursion could have been used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation (bsc#1105832). CVE-2018-15854: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly (bsc#1105832). CVE-2018-15855: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled (bsc#1105832). CVE-2018-15856: An infinite loop when reaching EOL unexpectedly could be used by local attackers to cause a denial of service during parsing of crafted keymap files (bsc#1105832). CVE-2018-15857: An invalid free in ExprAppendMultiKeysymList could have been used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file (bsc#1105832). CVE-2018-15858: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file (bsc#1105832). CVE-2018-15859: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled (bsc#1105832). CVE-2018-15861: Unchecked NULL pointer usage in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure (bsc#1105832). CVE-2018-15862: Unchecked NULL pointer usage in LookupModMask could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers (bsc#1105832). CVE-2018-15863: Unchecked NULL pointer usage in ResolveStateAndPredicate could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression (bsc#1105832). CVE-2018-15864: Unchecked NULL pointer usage in resolve_keysym could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created (bsc#1105832). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-18
    modified2019-01-02
    plugin id120161
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120161
    titleSUSE SLED15 / SLES15 Security Update : libxkbcommon (SUSE-SU-2018:3685-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2079.NASL
    descriptionAn update for Xorg is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es) : * libX11: Crash on invalid reply in XListExtensions in ListExt.c (CVE-2018-14598) * libX11: Off-by-one error in XListExtensions in ListExt.c (CVE-2018-14599) * libX11: Out of Bounds write in XListExtensions in ListExt.c (CVE-2018-14600) * libxkbcommon: Invalid free in ExprAppendMultiKeysymList resulting in a crash (CVE-2018-15857) * libxkbcommon: Endless recursion in xkbcomp/expr.c resulting in a crash (CVE-2018-15853) * libxkbcommon: NULL pointer dereference resulting in a crash (CVE-2018-15854) * libxkbcommon: NULL pointer dereference when handling xkb_geometry (CVE-2018-15855) * libxkbcommon: Infinite loop when reaching EOL unexpectedly resulting in a crash (CVE-2018-15856) * libxkbcommon: NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash (CVE-2018-15859) * libxkbcommon: NULL pointer dereference in ExprResolveLhs resulting in a crash (CVE-2018-15861) * libxkbcommon: NULL pointer dereference in LookupModMask resulting in a crash (CVE-2018-15862) * libxkbcommon: NULL pointer dereference in ResolveStateAndPredicate resulting in a crash (CVE-2018-15863) * libxkbcommon: NULL pointer dereference in resolve_keysym resulting in a crash (CVE-2018-15864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id127668
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127668
    titleRHEL 7 : Xorg (RHSA-2019:2079)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0199_LIBXKBCOMMON.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libxkbcommon packages installed that are affected by multiple vulnerabilities: - Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers. (CVE-2018-15862) - Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression. (CVE-2018-15863) - Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864) - Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation. (CVE-2018-15853) - Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859) - Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure. (CVE-2018-15861) - An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file. (CVE-2018-15857) - An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files. (CVE-2018-15856) - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled. (CVE-2018-15855) - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly. (CVE-2018-15854) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id130201
    published2019-10-24
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130201
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : libxkbcommon Multiple Vulnerabilities (NS-SA-2019-0199)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3786-2.NASL
    descriptionUSN-3786-1 fixed several vulnerabilities in libxkbcommon. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details : It was discovered that libxkbcommon incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018- 15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id118794
    published2018-11-07
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118794
    titleUbuntu 18.04 LTS : libxkbcommon vulnerabilities (USN-3786-2)

Redhat

advisories
rhsa
idRHSA-2019:2079
rpms
  • gdm-1:3.28.2-16.el7
  • gdm-debuginfo-1:3.28.2-16.el7
  • gdm-devel-1:3.28.2-16.el7
  • gdm-pam-extensions-devel-1:3.28.2-16.el7
  • libX11-0:1.6.7-2.el7
  • libX11-common-0:1.6.7-2.el7
  • libX11-debuginfo-0:1.6.7-2.el7
  • libX11-devel-0:1.6.7-2.el7
  • libxkbcommon-0:0.7.1-3.el7
  • libxkbcommon-debuginfo-0:0.7.1-3.el7
  • libxkbcommon-devel-0:0.7.1-3.el7
  • libxkbcommon-x11-0:0.7.1-3.el7
  • libxkbcommon-x11-devel-0:0.7.1-3.el7
  • mesa-libGLw-0:8.0.0-5.el7
  • mesa-libGLw-debuginfo-0:8.0.0-5.el7
  • mesa-libGLw-devel-0:8.0.0-5.el7
  • xorg-x11-drv-ati-0:19.0.1-2.el7
  • xorg-x11-drv-ati-debuginfo-0:19.0.1-2.el7
  • xorg-x11-drv-vesa-0:2.4.0-3.el7
  • xorg-x11-drv-vesa-debuginfo-0:2.4.0-3.el7
  • xorg-x11-drv-wacom-0:0.36.1-3.el7
  • xorg-x11-drv-wacom-debuginfo-0:0.36.1-3.el7
  • xorg-x11-drv-wacom-devel-0:0.36.1-3.el7
  • xorg-x11-server-Xdmx-0:1.20.4-7.el7
  • xorg-x11-server-Xephyr-0:1.20.4-7.el7
  • xorg-x11-server-Xnest-0:1.20.4-7.el7
  • xorg-x11-server-Xorg-0:1.20.4-7.el7
  • xorg-x11-server-Xvfb-0:1.20.4-7.el7
  • xorg-x11-server-Xwayland-0:1.20.4-7.el7
  • xorg-x11-server-common-0:1.20.4-7.el7
  • xorg-x11-server-debuginfo-0:1.20.4-7.el7
  • xorg-x11-server-devel-0:1.20.4-7.el7
  • xorg-x11-server-source-0:1.20.4-7.el7