There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3140 advisory.

  - The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers     to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
    (CVE-2017-18267)

  - There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps     through 0.3.0. A crafted input will lead to a remote denial of service attack. (CVE-2018-10733)

  - There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of     gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a     g_input_stream_read call. A crafted input will lead to a remote denial of service attack. (CVE-2018-10767)

  - There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu     package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu     packages such as for Poppler 0.41.0 are not affected. (CVE-2018-10768)

  - The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname. (CVE-2018-12910)

  - Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that     is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and     denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
    (CVE-2018-13988)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libgxps package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - There is a stack-based buffer over-read in calling GLib     in the function gxps_images_guess_content_type of     gxps-images.c in libgxps through 0.3.0 because it does     not reject negative return values from a     g_input_stream_read call. A crafted input will lead to     a remote denial of service attack.(CVE-2018-10767)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libgxps packages installed that are affected by multiple vulnerabilities:

  - There is a heap-based buffer over-read in the function     ft_font_face_hash of gxps-fonts.c in libgxps through     0.3.0. A crafted input will lead to a remote denial of     service attack. (CVE-2018-10733)

  - There is a stack-based buffer over-read in calling GLib     in the function gxps_images_guess_content_type of gxps-     images.c in libgxps through 0.3.0 because it does not     reject negative return values from a g_input_stream_read     call. A crafted input will lead to a remote denial of     service attack. (CVE-2018-10767)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

libgxps 0.3.1 release.

  - Fix font scaling when converting xps to pdf

  - Handle errors returned by archive_read_data in     GXPSArchive

  - Ensure gxps_archive_read_entry() fills the GError in     case of failure

  - Make the pdf generated by xpstopdf to be 96 dpi

  - Fix OUTPUT FILE description in man pages

  - Clear the GError before trying to load an image again in     gxps_images_get_image()

  - Fix integer overflow in png decoder

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libsoup: Crash in soup_cookie_jar.c:get_cookies() on     empty hostnames (CVE-2018-12910)

  - poppler: Infinite recursion in     fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function     allows denial of service (CVE-2017-18267)

  - libgxps: heap based buffer over read in     ft_font_face_hash function of gxps-fonts.c     (CVE-2018-10733)

  - libgxps: Stack-based buffer overflow in calling glib in     gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

  - poppler: NULL pointer dereference in     Annot.h:AnnotPath::getCoordsLength() allows for denial     of service via crafted PDF (CVE-2018-10768)

  - poppler: out of bounds read in pdfunite (CVE-2018-13988)

Additional Changes :

  - PackageKit is now aware of our SL7 minor release upgrade     tool.

An update is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GNOME is the default desktop environment of Red Hat Enterprise Linux.

Security Fix(es) :

* libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

* poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service (CVE-2017-18267)

* libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

* libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c (CVE-2018-10767)

* poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via crafted PDF (CVE-2018-10768)

* poppler: out of bounds read in pdfunite (CVE-2018-13988)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank chenyuan (NESA Lab) for reporting CVE-2018-10733 and CVE-2018-10767 and Hosein Askari for reporting CVE-2018-13988.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Add patch for CVE-2018-10767

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
181106	Oracle Linux 7 : GNOME (ELSA-2018-3140)	Nessus	Oracle Linux Local Security Checks	critical
135530	EulerOS 2.0 SP3 : libgxps (EulerOS-SA-2020-1401)	Nessus	Huawei Local Security Checks	medium
127223	NewStart CGSL CORE 5.04 / MAIN 5.04 : libgxps Multiple Vulnerabilities (NS-SA-2019-0044)	Nessus	NewStart CGSL Local Security Checks	medium
121079	Fedora 29 : libgxps (2019-8e9789a629)	Nessus	Fedora Local Security Checks	medium
119177	Scientific Linux Security Update : GNOME on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	critical
118995	CentOS 7 : PackageKit / accountsservice / adwaita-icon-theme / appstream-data / at-spi2-atk / etc (CESA-2018:3140)	Nessus	CentOS Local Security Checks	critical
118726	RHEL 7 : GNOME (RHSA-2018:3140)	Nessus	Red Hat Local Security Checks	critical
109873	Fedora 27 : libgxps (2018-46f3f13c68)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-10767

medium

Tenable Plugins

critical

medium

medium

medium

critical

critical

critical

medium