SB2018073020 - Denial of service in libxkbcommon

Main Vulnerability Database SB2018073020

SB2018073020 - Denial of service in libxkbcommon

Published: July 30, 2018 Updated: November 16, 2018

Security Bulletin ID SB2018073020

Severity

Low

Patch available

YES

Number of vulnerabilities 11

Exploitation vector Local access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2018-15853)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to endless recursion exists in xkbcomp/expr.c during insufficient validation of user-supplied input. A local attacker can supply a specially crafted keymap file, trigger boolean negation and cause the application to crash.

2) Improper input validation (CVE-ID: CVE-2018-15857)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an invalid-free error in the ExprAppendMultiKeysymList function, as defined in the xkbcomp/ast-build.c source code file. A local attacker can submit a specially crafted keymap file that submits malicious input and cause the application to crash.

3) Null pointer dereference (CVE-ID: CVE-2018-15854)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to unchecked NULL pointer usage condition when the XkbFile is mishandled. A local attacker can submit a specially crafted keymap file that submits malicious input, trigger NULL pointer dereference and cause the application to crash.

4) Null pointer dereference (CVE-ID: CVE-2018-15855)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to unchecked NULL pointer usage condition when the XkbFile is mishandled. A local attacker can submit a specially crafted keymap file that submits malicious input, trigger NULL pointer dereference and cause the application to crash.

5) Infinite loop (CVE-ID: CVE-2018-15856)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an infinite loop condition during insufficient validation of user-supplied input. A local attacker can submit a specially crafted keymap file that submits malicious input, trigger infinite loop and cause the application to crash.

6) Null pointer dereference (CVE-ID: CVE-2018-15864)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer usage condition by the resolve_keysym function, as defined in the xkbcomp/parser.y source code file. A local attacker can submit a specially crafted keymap file that submits malicious input to an affected system with a no-op modmaskexpression, trigger NULL pointer dereference and cause the application to crash.

7) Null pointer dereference (CVE-ID: CVE-2018-15863)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer usage condition by the ResolveStateAndPredicate function, as defined in the xkbcomp/compat.c source code file. A local attacker can submit a specially crafted keymap file that submits malicious input to an affected system with a no-op modmaskexpression, trigger NULL pointer dereference and cause the application to crash.

8) Null pointer dereference (CVE-ID: CVE-2018-15862)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer usage condition by the LookupModMask function, as defined in the xkbcomp/expr.c source code file. A local attacker can submit a specially crafted keymap file that submits malicious input to an affected system with invalid virtual modifiers, trigger NULL pointer dereference and cause the application to crash.

9) Null pointer dereference (CVE-ID: CVE-2018-15861)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer usage condition by the ExprResolveLhs function, as defined in the xkbcomp/expr.c source code file. A local attacker can submit a specially crafted keymap file that submits malicious input, trigger an xkb_intern_atom failure and cause the application to crash.

10) Null pointer dereference (CVE-ID: CVE-2018-15858)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer usage condition by the CopyKeyAliasesToKeymap function, as defined in the xkbcomp/keycodes.c source code file. A local attacker can submit a specially crafted keymap file that submits malicious input, trigger NULL pointer dereference and cause the application to crash.

11) Null pointer dereference (CVE-ID: CVE-2018-15859)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer usage condition by the ExprResolveLhs function, as defined in the xkbcomp/expr.c source code file. A local attacker can submit a specially crafted keymap file that submits malicious input, trigger NULL pointer dereference and cause the application to crash.

Remediation

Install update from vendor's website.

References