An update for Xorg is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Security Fix(es) :

* libX11: Crash on invalid reply in XListExtensions in ListExt.c (CVE-2018-14598)

* libX11: Off-by-one error in XListExtensions in ListExt.c (CVE-2018-14599)

* libX11: Out of Bounds write in XListExtensions in ListExt.c (CVE-2018-14600)

* libxkbcommon: Invalid free in ExprAppendMultiKeysymList resulting in a crash (CVE-2018-15857)

* libxkbcommon: Endless recursion in xkbcomp/expr.c resulting in a crash (CVE-2018-15853)

* libxkbcommon: NULL pointer dereference resulting in a crash (CVE-2018-15854)

* libxkbcommon: NULL pointer dereference when handling xkb_geometry (CVE-2018-15855)

* libxkbcommon: Infinite loop when reaching EOL unexpectedly resulting in a crash (CVE-2018-15856)

* libxkbcommon: NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash (CVE-2018-15859)

* libxkbcommon: NULL pointer dereference in ExprResolveLhs resulting in a crash (CVE-2018-15861)

* libxkbcommon: NULL pointer dereference in LookupModMask resulting in a crash (CVE-2018-15862)

* libxkbcommon: NULL pointer dereference in ResolveStateAndPredicate resulting in a crash (CVE-2018-15863)

* libxkbcommon: NULL pointer dereference in resolve_keysym resulting in a crash (CVE-2018-15864)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libxkbcommon packages installed that are affected by multiple vulnerabilities:

  - Unchecked NULL pointer usage in LookupModMask in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     with invalid virtual modifiers. (CVE-2018-15862)

  - Unchecked NULL pointer usage in ResolveStateAndPredicate     in xkbcomp/compat.c in xkbcommon before 0.8.2 could be     used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file with a no-op modmask expression.
    (CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in     xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file,     because a map access attempt can occur for a map that     was never created. (CVE-2018-15864)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon     and libxkbcommon before 0.8.1, which could be used by     local attackers to crash xkbcommon users by supplying a     crafted keymap file that triggers boolean negation.
    (CVE-2018-15853)

  - Unchecked NULL pointer usage when parsing invalid atoms     in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before     0.8.2 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a     crafted keymap file, because lookup failures are     mishandled. (CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     that triggers an xkb_intern_atom failure.
    (CVE-2018-15861)

  - An invalid free in ExprAppendMultiKeysymList in     xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap     parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

  - An infinite loop when reaching EOL unexpectedly in     compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a     denial of service during parsing of crafted keymap     files. (CVE-2018-15856)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1     could be used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because the XkbFile for an xkb_geometry     section was mishandled. (CVE-2018-15855)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1     could be used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because geometry tokens were desupported     incorrectly. (CVE-2018-15854)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has xorg-x11-drv-ati packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used     by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean     negation. (CVE-2018-15853)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were     desupported incorrectly. (CVE-2018-15854)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled. (CVE-2018-15855)

  - An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted     keymap files. (CVE-2018-15856)

  - An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

  - Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon     before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

  - Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by     local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file with invalid virtual modifiers. (CVE-2018-15862)

  - Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2     could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a     crafted keymap file with a no-op modmask expression. (CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mesa-libGLw packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used     by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean     negation. (CVE-2018-15853)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were     desupported incorrectly. (CVE-2018-15854)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled. (CVE-2018-15855)

  - An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted     keymap files. (CVE-2018-15856)

  - An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

  - Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon     before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

  - Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by     local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file with invalid virtual modifiers. (CVE-2018-15862)

  - Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2     could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a     crafted keymap file with a no-op modmask expression. (CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libxkbcommon to version 0.8.2 fixes the following issues :

  - Fix a few NULL-dereferences, out-of-bounds access and     undefined behavior in the XKB text format parser.

  - CVE-2018-15853: Endless recursion could have been used     by local attackers to crash xkbcommon users by supplying     a crafted keymap file that triggers boolean negation     (bsc#1105832).

  - CVE-2018-15854: Unchecked NULL pointer usage could have     been used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because geometry tokens were desupported     incorrectly (bsc#1105832).

  - CVE-2018-15855: Unchecked NULL pointer usage could have     been used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because the XkbFile for an xkb_geometry     section was mishandled (bsc#1105832).

  - CVE-2018-15856: An infinite loop when reaching EOL     unexpectedly could be used by local attackers to cause a     denial of service during parsing of crafted keymap files     (bsc#1105832).

  - CVE-2018-15857: An invalid free in     ExprAppendMultiKeysymList could have been used by local     attackers to crash xkbcommon keymap parsers or possibly     have unspecified other impact by supplying a crafted     keymap file (bsc#1105832).

  - CVE-2018-15858: Unchecked NULL pointer usage when     handling invalid aliases in CopyKeyAliasesToKeymap could     have been used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file (bsc#1105832).

  - CVE-2018-15859: Unchecked NULL pointer usage when     parsing invalid atoms in ExprResolveLhs could have been     used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because lookup failures are mishandled     (bsc#1105832).

  - CVE-2018-15861: Unchecked NULL pointer usage in     ExprResolveLhs could have been used by local attackers     to crash (NULL pointer dereference) the xkbcommon parser     by supplying a crafted keymap file that triggers an     xkb_intern_atom failure (bsc#1105832).

  - CVE-2018-15862: Unchecked NULL pointer usage in     LookupModMask could have been used by local attackers to     crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file with invalid virtual     modifiers (bsc#1105832).

  - CVE-2018-15863: Unchecked NULL pointer usage in     ResolveStateAndPredicate could have been used by local     attackers to crash (NULL pointer dereference) the     xkbcommon parser by supplying a crafted keymap file with     a no-op modmask expression (bsc#1105832).

  - CVE-2018-15864: Unchecked NULL pointer usage in     resolve_keysym could have been used by local attackers     to crash (NULL pointer dereference) the xkbcommon parser     by supplying a crafted keymap file, because a map access     attempt can occur for a map that was never created     (bsc#1105832).

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-201810-05 (xkbcommon: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxkbcommon. Please       review the CVE identifiers referenced below for details.
  Impact :

    A local attacker could supply a specially crafted keymap file possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the libxkbcommon packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An invalid free in ExprAppendMultiKeysymList in     xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap     parsers or possibly have unspecified other impact by     supplying a crafted keymap file.(CVE-2018-15857)

  - Unchecked NULL pointer usage in resolve_keysym in     xkbcomp/parser.y in xkbcommon before 0.8.2 could be     used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a     crafted keymap file, because a map access attempt can     occur for a map that was never created.(CVE-2018-15864)

  - Unchecked NULL pointer usage in     ResolveStateAndPredicate in xkbcomp/compat.c in     xkbcommon before 0.8.2 could be used by local attackers     to crash (NULL pointer dereference) the xkbcommon     parser by supplying a crafted keymap file with a no-op     modmask expression.(CVE-2018-15863)

  - Unchecked NULL pointer usage in LookupModMask in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     with invalid virtual modifiers.(CVE-2018-15862)

  - Unchecked NULL pointer usage in ExprResolveLhs in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     that triggers an xkb_intern_atom     failure.(CVE-2018-15861)

  - Unchecked NULL pointer usage when parsing invalid atoms     in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before     0.8.2 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying     a crafted keymap file, because lookup failures are     mishandled.(CVE-2018-15859)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon     and libxkbcommon before 0.8.1, which could be used by     local attackers to crash xkbcommon users by supplying a     crafted keymap file that triggers boolean     negation.(CVE-2018-15853)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1433 advisory.

    It was discovered that libX11 does not properly validate input coming from the server, causing     XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make     XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a     malicious X server or modify the data coming from one, could use this flaw to crash the application using     libX11, resulting in a denial of service.(CVE-2018-14598)

    An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and     XListFonts(). An attacker who can either configure a malicious X server or modify the data coming from one     could use this flaw to make the program crash or have other unspecified effects, caused by the memory     corruption.(CVE-2018-14599)

    An out of bounds write, limited to NULL bytes, was discovered in libX11 in functions XListExtensions() and     XGetFontPath(). The length field is considered as a signed value, which makes the library access memory     before the intended buffer. An attacker who can either configure a malicious X server or modify the data     coming from one could use this flaw to make the program crash or have other unspecified effects, caused by     the memory corruption.(CVE-2018-14600)

    An uncontrolled recursion flaw was found in libxkbcommon in the way it parses boolean expressions. A     specially crafted file provided to xkbcomp could crash the application. (CVE-2018-15853)

    Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were     desupported incorrectly. (CVE-2018-15854)

    Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled. (CVE-2018-15855)

    An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted     keymap files. (CVE-2018-15856)

    An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

    Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon     before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)

    Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

    Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by     local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file with invalid virtual modifiers. (CVE-2018-15862)

    Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2     could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a     crafted keymap file with a no-op modmask expression. (CVE-2018-15863)

    Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libX11: Crash on invalid reply in XListExtensions in     ListExt.c (CVE-2018-14598)

  - libX11: Off-by-one error in XListExtensions in ListExt.c     (CVE-2018-14599)

  - libX11: Out of Bounds write in XListExtensions in     ListExt.c (CVE-2018-14600)

  - libxkbcommon: Invalid free in ExprAppendMultiKeysymList     resulting in a crash (CVE-2018-15857)

  - libxkbcommon: Endless recursion in xkbcomp/expr.c     resulting in a crash (CVE-2018-15853)

  - libxkbcommon: NULL pointer dereference resulting in a     crash (CVE-2018-15854)

  - libxkbcommon: NULL pointer dereference when handling     xkb_geometry (CVE-2018-15855)

  - libxkbcommon: Infinite loop when reaching EOL     unexpectedly resulting in a crash (CVE-2018-15856)

  - libxkbcommon: NULL pointer dereference when parsing     invalid atoms in ExprResolveLhs resulting in a crash     (CVE-2018-15859)

  - libxkbcommon: NULL pointer dereference in ExprResolveLhs     resulting in a crash (CVE-2018-15861)

  - libxkbcommon: NULL pointer dereference in LookupModMask     resulting in a crash (CVE-2018-15862)

  - libxkbcommon: NULL pointer dereference in     ResolveStateAndPredicate resulting in a crash     (CVE-2018-15863)

  - libxkbcommon: NULL pointer dereference in resolve_keysym     resulting in a crash (CVE-2018-15864)

The version of AOS installed on the remote host is prior to 5.10.9. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.10.9 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
128349	CentOS 7 : gdm / libX11 / libxkbcommon / xorg-x11-drv-ati / xorg-x11-drv-vesa / etc (CESA-2019:2079)	Nessus	CentOS Local Security Checks	8/30/2019	4/30/2024	critical
130201	NewStart CGSL CORE 5.04 / MAIN 5.04 : libxkbcommon Multiple Vulnerabilities (NS-SA-2019-0199)	Nessus	NewStart CGSL Local Security Checks	10/24/2019	1/14/2021	high
174058	NewStart CGSL CORE 5.05 / MAIN 5.05 : xorg-x11-drv-ati Multiple Vulnerabilities (NS-SA-2023-0026)	Nessus	NewStart CGSL Local Security Checks	4/11/2023	4/11/2023	critical
174065	NewStart CGSL CORE 5.05 / MAIN 5.05 : mesa-libGLw Multiple Vulnerabilities (NS-SA-2023-0024)	Nessus	NewStart CGSL Local Security Checks	4/11/2023	4/11/2023	critical
123373	openSUSE Security Update : libxkbcommon (openSUSE-2019-913)	Nessus	SuSE Local Security Checks	3/27/2019	6/10/2024	high
118505	GLSA-201810-05 : xkbcommon: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/31/2018	1/31/2022	high
131814	EulerOS 2.0 SP5 : libxkbcommon (EulerOS-SA-2019-2540)	Nessus	Huawei Local Security Checks	12/9/2019	4/5/2024	high
137090	Amazon Linux 2 : xorg-x11-server (ALAS-2020-1433)	Nessus	Amazon Linux Local Security Checks	6/4/2020	12/11/2024	critical
128206	Scientific Linux Security Update : Xorg on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	8/27/2019	5/1/2024	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	9/1/2022	7/22/2025	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

high

high

high

critical

critical

critical