The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2079 advisory.

    - Fixes for       CVE-2018-15864, CVE-2018-15863, CVE-2018-15862, CVE-2018-15861,       CVE-2018-15859  CVE-2018-15857, CVE-2018-15856, CVE-2018-15855,       CVE-2018-15854, CVE-2018-15853

    mesa-libGLw

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has xorg-x11-drv-ati packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used     by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean     negation. (CVE-2018-15853)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were     desupported incorrectly. (CVE-2018-15854)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled. (CVE-2018-15855)

  - An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted     keymap files. (CVE-2018-15856)

  - An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

  - Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon     before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

  - Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by     local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file with invalid virtual modifiers. (CVE-2018-15862)

  - Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2     could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a     crafted keymap file with a no-op modmask expression. (CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mesa-libGLw packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used     by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean     negation. (CVE-2018-15853)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were     desupported incorrectly. (CVE-2018-15854)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled. (CVE-2018-15855)

  - An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted     keymap files. (CVE-2018-15856)

  - An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

  - Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon     before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

  - Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by     local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file with invalid virtual modifiers. (CVE-2018-15862)

  - Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2     could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a     crafted keymap file with a no-op modmask expression. (CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxkbcommon packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1     could be used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a     crafted keymap file, because geometry tokens were     desupported incorrectly.(CVE-2018-15854)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1     could be used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a     crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled.(CVE-2018-15855)

  - An infinite loop when reaching EOL unexpectedly in     compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause     a denial of service during parsing of crafted keymap     files.(CVE-2018-15856)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libxkbcommon packages installed that are affected by multiple vulnerabilities:

  - Unchecked NULL pointer usage in LookupModMask in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     with invalid virtual modifiers. (CVE-2018-15862)

  - Unchecked NULL pointer usage in ResolveStateAndPredicate     in xkbcomp/compat.c in xkbcommon before 0.8.2 could be     used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file with a no-op modmask expression.
    (CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in     xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file,     because a map access attempt can occur for a map that     was never created. (CVE-2018-15864)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon     and libxkbcommon before 0.8.1, which could be used by     local attackers to crash xkbcommon users by supplying a     crafted keymap file that triggers boolean negation.
    (CVE-2018-15853)

  - Unchecked NULL pointer usage when parsing invalid atoms     in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before     0.8.2 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a     crafted keymap file, because lookup failures are     mishandled. (CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     that triggers an xkb_intern_atom failure.
    (CVE-2018-15861)

  - An invalid free in ExprAppendMultiKeysymList in     xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap     parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

  - An infinite loop when reaching EOL unexpectedly in     compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a     denial of service during parsing of crafted keymap     files. (CVE-2018-15856)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1     could be used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because the XkbFile for an xkb_geometry     section was mishandled. (CVE-2018-15855)

  - Unchecked NULL pointer usage in xkbcommon before 0.8.1     could be used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a crafted     keymap file, because geometry tokens were desupported     incorrectly. (CVE-2018-15854)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機受到 GLSA-201810-05 中所述的弱點影響 (xkbcommon：多個弱點) 在 xkbcommon 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。影響：本機攻擊者可提供特製的 keymap 檔案，進而可能導致拒絕服務情形。因應措施：目前尚無已知的因應措施。

遠端 Ubuntu 18.04 LTS 主機上安裝的套件受到 USN-3786-2 公告中所提及的多個弱點影響。

    USN-3786-1 已修正 libxkbcommon 中的數個弱點。此更新提供 Ubuntu 18.04 LTS 的對應更新。



Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

安全性修正：- libX11：ListExt.c 的 XListExtensions 中發生無效回覆，進而導致當機 (CVE-2018-14598) - libX11：ListExt.c 的 XListExtensions 中發生差一錯誤 (CVE-2018-14599) - libX11：ListExt.c 的 XListExtensions 中發生超出邊界 (CVE-2018-14600) - libxkbcommon：ExprAppendMultiKeysymList 中發生無效釋放，進而導致當機 (CVE-2018-15857) - libxkbcommon：xkbcomp/expr.c 中發生無限遞迴，進而導致當機 (CVE-2018-15853) - libxkbcommon：NULL 指標解除參照導致當機 (CVE-2018-15854) - libxkbcommon：處理 xkb_geometry 時發生 NULL 指標解除參照 (CVE-2018-15855) - libxkbcommon：非預期地連線 EOL 時發生無限迴圈，進而導致當機 (CVE-2018-15856) - libxkbcommon：在 ExprResolveLhs 中剖析無效的服務元時發生 NULL 指標解除參照，進而導致當機 (CVE-2018-15859) - libxkbcommon：ExprResolveLhs 中的 NULL 指標解除參照導致當機 (CVE-2018-15861) - libxkbcommon：LookupModMask 中的 NULL 指標解除參照導致當機 (CVE-2018-15862) - libxkbcommon：ResolveStateAndPredicate 中 NULL 指標解除參照導致當機 (CVE-2018-15863) - libxkbcommon：resolve_keysym 中的 NULL 指標解除參照導致當機 (CVE-2018-15864)

遠端主機上安裝的 AOS 版本低於 5.11.2。因此，它受到 NXSA-AOS-5.11.2 公告中所提及的多個弱點影響。

  - Gnome Pango 1.42 及更高版本受到下列弱點影響：緩衝區溢位。影響為：堆積型緩衝區溢位可用來執行程式碼。元件為：函式名稱：pango_log2vis_get_embedding_levels，nchars 和迴圈條件的指派。攻擊媒介為：當應用程式將無效的 utf-8 字串傳送至 pango_itemize 之類的函式時，錯誤可能會遭到利用。(CVE-2019-1010238)

  - curl 7.61.1 之前版本容易受到 NTLM 驗證碼中的緩衝區溢位弱點影響。內部函式 Curl_ntlm_core_mk_nt_hash 會將密碼長度乘以二 (SUM) 以算出從堆積配置的暫存儲存區域大小。接著，長度值之後會用來逐一查看密碼，並在配置的儲存緩衝區中產生輸出。在具有 32 位元 size_t 的系統上，當密碼長度超過 2GB (2^31 個位元組) 時，計算 SUM 的數學會觸發整數溢位。此整數溢位通常會造成實際配置非常小的緩衝區，而不是預期非常大的緩衝區，進而利用該緩衝區結束堆積緩衝區溢位。(此錯誤與 CVE-2017-8816 基本相同。)(CVE-2018-14618)

  - 在 libX11 1.6.5 和之前的所有版本中，發現 ListExt.c 的 XListExtensions 中存在問題。惡意伺服器可傳送第一個字串會發生溢位的回覆，導致之後釋放設定為 NULL 的變數，進而造成拒絕服務 (分割錯誤)。(CVE-2018-14598)

  - 在 libX11 1.6.5 和之前所有版本中發現一個問題。ListExt.c 中的 XListExtensions 函式容易因惡意伺服器端回應而發生差一錯誤，從而造成 DoS 或可能導致其他不明影響。(CVE-2018-14599)

  - 在 libX11 1.6.5 和之前所有版本中發現一個問題。ListExt.c 中的 XListExtensions 函式會將變數解譯為已簽署，而不是未簽署，從而導致超出邊界寫入 (最多 128 個位元組)，進而造成拒絕服務或可能觸發遠端程式碼執行。(CVE-2018-14600)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
180786	Oracle Linux 7 : Xorg (ELSA-2019-2079)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	critical
174058	NewStart CGSL CORE 5.05 / MAIN 5.05 : xorg-x11-drv-ati Multiple Vulnerabilities (NS-SA-2023-0026)	Nessus	NewStart CGSL Local Security Checks	2023/4/11	2023/4/11	critical
174065	NewStart CGSL CORE 5.05 / MAIN 5.05 : mesa-libGLw Multiple Vulnerabilities (NS-SA-2023-0024)	Nessus	NewStart CGSL Local Security Checks	2023/4/11	2023/4/11	critical
144269	EulerOS 2.0 SP5 : libxkbcommon (EulerOS-SA-2020-2554)	Nessus	Huawei Local Security Checks	2020/12/15	2024/2/1	medium
132511	NewStart CGSL CORE 5.05 / MAIN 5.05 : libxkbcommon Multiple Vulnerabilities (NS-SA-2019-0246)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2021/1/14	high
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	2022/9/1	2025/7/22	critical
118505	GLSA-201810-05：xkbcommon：多個弱點	Nessus	Gentoo Local Security Checks	2018/10/31	2022/1/31	high
118794	Ubuntu 18.04 LTS：libxkbcommon 弱點 (USN-3786-2)	Nessus	Ubuntu Local Security Checks	2018/11/7	2024/10/29	high
128206	Scientific Linux 安全性更新：SL7.x x86_64 上的 Xorg	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	critical
164608	Nutanix AOS：多個弱點 (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical

检测

插件搜索

critical

critical

critical

medium

high

critical

high

high

critical

critical