Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0037-1 advisory.

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used     by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean     negation. (CVE-2018-15853)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were     desupported incorrectly. (CVE-2018-15854)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled. (CVE-2018-15855)

  - An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted     keymap files. (CVE-2018-15856)

  - An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

  - Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c     in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the     xkbcommon parser by supplying a crafted keymap file. (CVE-2018-15858)

  - Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon     before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

  - Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by     local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file with invalid virtual modifiers. (CVE-2018-15862)

  - Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2     could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a     crafted keymap file with a no-op modmask expression. (CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libxkbcommon package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Unchecked NULL pointer usage when handling invalid     aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c     in xkbcommon before 0.8.1 could be used by local     attackers to crash (NULL pointer dereference) the     xkbcommon parser by supplying a crafted keymap     file.(CVE-2018-15858)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libxkbcommon packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Unchecked NULL pointer usage when handling invalid     aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c     in xkbcommon before 0.8.1 could be used by local     attackers to crash (NULL pointer dereference) the     xkbcommon parser by supplying a crafted keymap     file.(CVE-2018-15858)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxkbcommon to version 0.8.2 fixes the following issues :

  - Fix a few NULL-dereferences, out-of-bounds access and     undefined behavior in the XKB text format parser.

  - CVE-2018-15853: Endless recursion could have been used     by local attackers to crash xkbcommon users by supplying     a crafted keymap file that triggers boolean negation     (bsc#1105832).

  - CVE-2018-15854: Unchecked NULL pointer usage could have     been used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because geometry tokens were desupported     incorrectly (bsc#1105832).

  - CVE-2018-15855: Unchecked NULL pointer usage could have     been used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because the XkbFile for an xkb_geometry     section was mishandled (bsc#1105832).

  - CVE-2018-15856: An infinite loop when reaching EOL     unexpectedly could be used by local attackers to cause a     denial of service during parsing of crafted keymap files     (bsc#1105832).

  - CVE-2018-15857: An invalid free in     ExprAppendMultiKeysymList could have been used by local     attackers to crash xkbcommon keymap parsers or possibly     have unspecified other impact by supplying a crafted     keymap file (bsc#1105832).

  - CVE-2018-15858: Unchecked NULL pointer usage when     handling invalid aliases in CopyKeyAliasesToKeymap could     have been used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file (bsc#1105832).

  - CVE-2018-15859: Unchecked NULL pointer usage when     parsing invalid atoms in ExprResolveLhs could have been     used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because lookup failures are mishandled     (bsc#1105832).

  - CVE-2018-15861: Unchecked NULL pointer usage in     ExprResolveLhs could have been used by local attackers     to crash (NULL pointer dereference) the xkbcommon parser     by supplying a crafted keymap file that triggers an     xkb_intern_atom failure (bsc#1105832).

  - CVE-2018-15862: Unchecked NULL pointer usage in     LookupModMask could have been used by local attackers to     crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file with invalid virtual     modifiers (bsc#1105832).

  - CVE-2018-15863: Unchecked NULL pointer usage in     ResolveStateAndPredicate could have been used by local     attackers to crash (NULL pointer dereference) the     xkbcommon parser by supplying a crafted keymap file with     a no-op modmask expression (bsc#1105832).

  - CVE-2018-15864: Unchecked NULL pointer usage in     resolve_keysym could have been used by local attackers     to crash (NULL pointer dereference) the xkbcommon parser     by supplying a crafted keymap file, because a map access     attempt can occur for a map that was never created     (bsc#1105832).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libxkbcommon to version 0.8.2 fixes the following issues :

Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser.

CVE-2018-15853: Endless recursion could have been used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation (bsc#1105832).

CVE-2018-15854: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly (bsc#1105832).

CVE-2018-15855: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled (bsc#1105832).

CVE-2018-15856: An infinite loop when reaching EOL unexpectedly could be used by local attackers to cause a denial of service during parsing of crafted keymap files (bsc#1105832).

CVE-2018-15857: An invalid free in ExprAppendMultiKeysymList could have been used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file (bsc#1105832).

CVE-2018-15858: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file (bsc#1105832).

CVE-2018-15859: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled (bsc#1105832).

CVE-2018-15861: Unchecked NULL pointer usage in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure (bsc#1105832).

CVE-2018-15862: Unchecked NULL pointer usage in LookupModMask could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers (bsc#1105832).

CVE-2018-15863: Unchecked NULL pointer usage in ResolveStateAndPredicate could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression (bsc#1105832).

CVE-2018-15864: Unchecked NULL pointer usage in resolve_keysym could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created (bsc#1105832).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3786-1 fixed several vulnerabilities in libxkbcommon. This update provides the corresponding update for Ubuntu 18.04 LTS.

Original advisory details :

It was discovered that libxkbcommon incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service. (CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018- 15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201810-05 (xkbcommon: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxkbcommon. Please       review the CVE identifiers referenced below for details.
  Impact :

    A local attacker could supply a specially crafted keymap file possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

It was discovered that libxkbcommon incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service. (CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
187661	SUSE SLES12 Security Update : libxkbcommon (SUSE-SU-2024:0037-1)	Nessus	SuSE Local Security Checks	high
136221	EulerOS Virtualization for ARM 64 3.0.2.0 : libxkbcommon (EulerOS-SA-2020-1518)	Nessus	Huawei Local Security Checks	medium
132363	EulerOS 2.0 SP5 : libxkbcommon (EulerOS-SA-2019-2696)	Nessus	Huawei Local Security Checks	medium
123373	openSUSE Security Update : libxkbcommon (openSUSE-2019-913)	Nessus	SuSE Local Security Checks	high
120161	SUSE SLED15 / SLES15 Security Update : libxkbcommon (SUSE-SU-2018:3685-1)	Nessus	SuSE Local Security Checks	high
119023	openSUSE Security Update : libxkbcommon (openSUSE-2018-1418)	Nessus	SuSE Local Security Checks	high
118794	Ubuntu 18.04 LTS : libxkbcommon vulnerabilities (USN-3786-2)	Nessus	Ubuntu Local Security Checks	high
118505	GLSA-201810-05 : xkbcommon: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
117996	Ubuntu 14.04 LTS / 16.04 LTS : libxkbcommon vulnerabilities (USN-3786-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-15858

medium

Tenable Plugins

high

medium

medium

high

high

high

high

high

high