The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2079 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * libX11: Crash on invalid reply in XListExtensions in ListExt.c (CVE-2018-14598)

    * libX11: Off-by-one error in XListExtensions in ListExt.c (CVE-2018-14599)

    * libX11: Out of Bounds write in XListExtensions in ListExt.c (CVE-2018-14600)

    * libxkbcommon: Invalid free in ExprAppendMultiKeysymList resulting in a crash (CVE-2018-15857)

    * libxkbcommon: Endless recursion in xkbcomp/expr.c resulting in a crash (CVE-2018-15853)

    * libxkbcommon: NULL pointer dereference resulting in a crash (CVE-2018-15854)

    * libxkbcommon: NULL pointer dereference when handling xkb_geometry (CVE-2018-15855)

    * libxkbcommon: Infinite loop when reaching EOL unexpectedly resulting in a crash (CVE-2018-15856)

    * libxkbcommon: NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash     (CVE-2018-15859)

    * libxkbcommon: NULL pointer dereference in ExprResolveLhs resulting in a crash (CVE-2018-15861)

    * libxkbcommon: NULL pointer dereference in LookupModMask resulting in a crash (CVE-2018-15862)

    * libxkbcommon: NULL pointer dereference in ResolveStateAndPredicate resulting in a crash (CVE-2018-15863)

    * libxkbcommon: NULL pointer dereference in resolve_keysym resulting in a crash (CVE-2018-15864)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxkbcommon packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An invalid free in ExprAppendMultiKeysymList in     xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap     parsers or possibly have unspecified other impact by     supplying a crafted keymap file.(CVE-2018-15857)

  - Unchecked NULL pointer usage in resolve_keysym in     xkbcomp/parser.y in xkbcommon before 0.8.2 could be     used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a     crafted keymap file, because a map access attempt can     occur for a map that was never created.(CVE-2018-15864)

  - Unchecked NULL pointer usage in     ResolveStateAndPredicate in xkbcomp/compat.c in     xkbcommon before 0.8.2 could be used by local attackers     to crash (NULL pointer dereference) the xkbcommon     parser by supplying a crafted keymap file with a no-op     modmask expression.(CVE-2018-15863)

  - Unchecked NULL pointer usage in LookupModMask in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     with invalid virtual modifiers.(CVE-2018-15862)

  - Unchecked NULL pointer usage in ExprResolveLhs in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     that triggers an xkb_intern_atom     failure.(CVE-2018-15861)

  - Unchecked NULL pointer usage when parsing invalid atoms     in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before     0.8.2 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying     a crafted keymap file, because lookup failures are     mishandled.(CVE-2018-15859)

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon     and libxkbcommon before 0.8.1, which could be used by     local attackers to crash xkbcommon users by supplying a     crafted keymap file that triggers boolean     negation.(CVE-2018-15853)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxkbcommon package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Endless recursion exists in xkbcomp/expr.c in xkbcommon     and libxkbcommon before 0.8.1, which could be used by     local attackers to crash xkbcommon users by supplying a     crafted keymap file that triggers boolean     negation.(CVE-2018-15853)

  - Unchecked NULL pointer usage when parsing invalid atoms     in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before     0.8.2 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying     a crafted keymap file, because lookup failures are     mishandled.(CVE-2018-15859)

  - Unchecked NULL pointer usage in ExprResolveLhs in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     that triggers an xkb_intern_atom     failure.(CVE-2018-15861)

  - Unchecked NULL pointer usage in LookupModMask in     xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference)     the xkbcommon parser by supplying a crafted keymap file     with invalid virtual modifiers.(CVE-2018-15862)

  - Unchecked NULL pointer usage in     ResolveStateAndPredicate in xkbcomp/compat.c in     xkbcommon before 0.8.2 could be used by local attackers     to crash (NULL pointer dereference) the xkbcommon     parser by supplying a crafted keymap file with a no-op     modmask expression.(CVE-2018-15863)

  - Unchecked NULL pointer usage in resolve_keysym in     xkbcomp/parser.y in xkbcommon before 0.8.2 could be     used by local attackers to crash (NULL pointer     dereference) the xkbcommon parser by supplying a     crafted keymap file, because a map access attempt can     occur for a map that was never created.(CVE-2018-15864)

  - An invalid free in ExprAppendMultiKeysymList in     xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap     parsers or possibly have unspecified other impact by     supplying a crafted keymap file.(CVE-2018-15857)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for Xorg is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Security Fix(es) :

* libX11: Crash on invalid reply in XListExtensions in ListExt.c (CVE-2018-14598)

* libX11: Off-by-one error in XListExtensions in ListExt.c (CVE-2018-14599)

* libX11: Out of Bounds write in XListExtensions in ListExt.c (CVE-2018-14600)

* libxkbcommon: Invalid free in ExprAppendMultiKeysymList resulting in a crash (CVE-2018-15857)

* libxkbcommon: Endless recursion in xkbcomp/expr.c resulting in a crash (CVE-2018-15853)

* libxkbcommon: NULL pointer dereference resulting in a crash (CVE-2018-15854)

* libxkbcommon: NULL pointer dereference when handling xkb_geometry (CVE-2018-15855)

* libxkbcommon: Infinite loop when reaching EOL unexpectedly resulting in a crash (CVE-2018-15856)

* libxkbcommon: NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash (CVE-2018-15859)

* libxkbcommon: NULL pointer dereference in ExprResolveLhs resulting in a crash (CVE-2018-15861)

* libxkbcommon: NULL pointer dereference in LookupModMask resulting in a crash (CVE-2018-15862)

* libxkbcommon: NULL pointer dereference in ResolveStateAndPredicate resulting in a crash (CVE-2018-15863)

* libxkbcommon: NULL pointer dereference in resolve_keysym resulting in a crash (CVE-2018-15864)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

遠端主機受到 GLSA-201810-05 中所述的弱點影響 (xkbcommon：多個弱點) 在 xkbcommon 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。影響：本機攻擊者可提供特製的 keymap 檔案，進而可能導致拒絕服務情形。因應措施：目前尚無已知的因應措施。

遠端 Ubuntu 18.04 LTS 主機上安裝的套件受到 USN-3786-2 公告中所提及的多個弱點影響。

    USN-3786-1 已修正 libxkbcommon 中的數個弱點。此更新提供 Ubuntu 18.04 LTS 的對應更新。



Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

安全性修正：- libX11：ListExt.c 的 XListExtensions 中發生無效回覆，進而導致當機 (CVE-2018-14598) - libX11：ListExt.c 的 XListExtensions 中發生差一錯誤 (CVE-2018-14599) - libX11：ListExt.c 的 XListExtensions 中發生超出邊界 (CVE-2018-14600) - libxkbcommon：ExprAppendMultiKeysymList 中發生無效釋放，進而導致當機 (CVE-2018-15857) - libxkbcommon：xkbcomp/expr.c 中發生無限遞迴，進而導致當機 (CVE-2018-15853) - libxkbcommon：NULL 指標解除參照導致當機 (CVE-2018-15854) - libxkbcommon：處理 xkb_geometry 時發生 NULL 指標解除參照 (CVE-2018-15855) - libxkbcommon：非預期地連線 EOL 時發生無限迴圈，進而導致當機 (CVE-2018-15856) - libxkbcommon：在 ExprResolveLhs 中剖析無效的服務元時發生 NULL 指標解除參照，進而導致當機 (CVE-2018-15859) - libxkbcommon：ExprResolveLhs 中的 NULL 指標解除參照導致當機 (CVE-2018-15861) - libxkbcommon：LookupModMask 中的 NULL 指標解除參照導致當機 (CVE-2018-15862) - libxkbcommon：ResolveStateAndPredicate 中 NULL 指標解除參照導致當機 (CVE-2018-15863) - libxkbcommon：resolve_keysym 中的 NULL 指標解除參照導致當機 (CVE-2018-15864)

遠端主機上安裝的 AOS 版本低於 5.11.2。因此，它受到 NXSA-AOS-5.11.2 公告中所提及的多個弱點影響。

  - Gnome Pango 1.42 及更高版本受到下列弱點影響：緩衝區溢位。影響為：堆積型緩衝區溢位可用來執行程式碼。元件為：函式名稱：pango_log2vis_get_embedding_levels，nchars 和迴圈條件的指派。攻擊媒介為：當應用程式將無效的 utf-8 字串傳送至 pango_itemize 之類的函式時，錯誤可能會遭到利用。(CVE-2019-1010238)

  - curl 7.61.1 之前版本容易受到 NTLM 驗證碼中的緩衝區溢位弱點影響。內部函式 Curl_ntlm_core_mk_nt_hash 會將密碼長度乘以二 (SUM) 以算出從堆積配置的暫存儲存區域大小。接著，長度值之後會用來逐一查看密碼，並在配置的儲存緩衝區中產生輸出。在具有 32 位元 size_t 的系統上，當密碼長度超過 2GB (2^31 個位元組) 時，計算 SUM 的數學會觸發整數溢位。此整數溢位通常會造成實際配置非常小的緩衝區，而不是預期非常大的緩衝區，進而利用該緩衝區結束堆積緩衝區溢位。(此錯誤與 CVE-2017-8816 基本相同。)(CVE-2018-14618)

  - 在 libX11 1.6.5 和之前的所有版本中，發現 ListExt.c 的 XListExtensions 中存在問題。惡意伺服器可傳送第一個字串會發生溢位的回覆，導致之後釋放設定為 NULL 的變數，進而造成拒絕服務 (分割錯誤)。(CVE-2018-14598)

  - 在 libX11 1.6.5 和之前所有版本中發現一個問題。ListExt.c 中的 XListExtensions 函式容易因惡意伺服器端回應而發生差一錯誤，從而造成 DoS 或可能導致其他不明影響。(CVE-2018-14599)

  - 在 libX11 1.6.5 和之前所有版本中發現一個問題。ListExt.c 中的 XListExtensions 函式會將變數解譯為已簽署，而不是未簽署，從而導致超出邊界寫入 (最多 128 個位元組)，進而造成拒絕服務或可能觸發遠端程式碼執行。(CVE-2018-14600)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

安全修复：- libX11：ListExt.c 的 XListExtensions 中发生无效回复，进而导致崩溃 (CVE-2018-14598) - libX11：ListExt.c 的 XListExtensions 中发生差一错误 (CVE-2018-14599) - libX11：ListExt.c 的 XListExtensions 中发生越界写入 (CVE-2018-14600) - libxkbcommon：ExprAppendMultiKeysymList 中发生无效释放，进而导致崩溃 (CVE-2018-15857) - libxkbcommon：xkbcomp/expr.c 中发生无限递回，进而导致崩溃 (CVE-2018-15853) - libxkbcommon：空指针取消引用导致崩溃 (CVE-2018-15854) - libxkbcommon：处理　xkb_geometry　时发生空指针取消引用 (CVE-2018-15855) - libxkbcommon：意外连线 EOL 时发生无限循环，进而导致崩溃 (CVE-2018-15856) - libxkbcommon：在 ExprResolveLhs 中解析无效的原子时发生空指针取消引用，进而导致崩溃 (CVE-2018-15859) - libxkbcommon：ExprResolveLhs 中的空指针取消引用导致崩溃 (CVE-2018-15861) - libxkbcommon：LookupModMask 中的空指针取消引用导致崩溃 (CVE-2018-15862) - libxkbcommon：ResolveStateAndPredicate 中的空指针取消引用导致崩溃 (CVE-2018-15863) - libxkbcommon：resolve_keysym 中的空指针取消引用导致崩溃 (CVE-2018-15864)

远程主机受到 GLSA-201810-05 中所述漏洞的影响（xkbcommon：多个漏洞）在 libxkbcommon 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。影响：本地攻击者可提供特别构建的 keymap 文件，从而可能导致拒绝服务情况。解决方法：目前无任何已知的解决方法。

远程 Ubuntu 18.04 LTS 主机上安装的多个程序包受到 USN-3786-2 公告中提及的多个漏洞影响。

    USN-3786-1 修复了 libxkbcommon 中的多个漏洞。此更新提供针对 Ubuntu 18.04 LTS 的相应更新。



Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 AOS 版本低于 5.11.2。因此，其受到 NXSA-AOS-5.11.2 公告中提及的多个漏洞影响。

  - Gnome Pango 1.42 及更高版本受到下列因素影响：缓冲区溢出。影响为：基于堆的缓冲区溢出可用来执行代码。组件为：函数名称：pango_log2vis_get_embedding_levels，nchars 和无限循环的任务。攻击向量为：当应用程序向 pango_itemize 等函数传递无效 utf-8 字符串时，可使用该错误。(CVE-2019-1010238)

  - curl 7.61.1 之前版本容易受到 NTLM 验证码中的缓冲区溢出漏洞影响。内部函数 Curl_ntlm_core_mk_nt_hash 会将密码长度乘以二 (SUM) 以计算从堆配置的临时存储区域大小。长度值之后会用来逐一循环访问密码，并在分配的存储缓冲区中生成输出。在具有 32 位 size_t 的系统上，当密码长度超过 2GB (2^31 个字节) 时，计算 SUM 的数学会触发整数溢出。此整数溢出通常会造成实际分配非常小的缓冲区，而不是预期非常大的缓冲区，进而利用该缓冲区结束堆缓冲区溢出。（此错误与 CVE-2017-8816 基本相同。）(CVE-2018-14618)

  - 在 libX11 1.6.5 及之前所有版本中，在 ListExt.c 的 XListExtensions 中发现一个问题。恶意服务器可发送首个字符串溢出的回复，造成变量设置为空，随后又将其释放，从而导致段错误和拒绝服务。(CVE-2018-14598)

  - 在 libX11 1.6.5 及之前所有版本中发现一个问题。ListExt.c 中的 XListExtensions 函数容易受到由恶意服务器响应导致的大小差一错误影响，从而导致 DoS 或可能造成其他不明影响。(CVE-2018-14599)

  - 在 libX11 1.6.5 及之前所有版本中发现一个问题。ListExt.c 中的 XListExtensions 函数会将变量解释为已签名，而非未签名，这可造成越界写入（最多 128 个字节），从而导致拒绝服务或远程代码执行。(CVE-2018-14600)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
127668	RHEL 7 : Xorg (RHSA-2019:2079)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	critical
131814	EulerOS 2.0 SP5 : libxkbcommon (EulerOS-SA-2019-2540)	Nessus	Huawei Local Security Checks	2019/12/9	2024/4/5	high
134535	EulerOS Virtualization for ARM 64 3.0.2.0 : libxkbcommon (EulerOS-SA-2020-1246)	Nessus	Huawei Local Security Checks	2020/3/13	2024/3/22	high
128349	CentOS 7 : gdm / libX11 / libxkbcommon / xorg-x11-drv-ati / xorg-x11-drv-vesa / etc (CESA-2019:2079)	Nessus	CentOS Local Security Checks	2019/8/30	2024/4/30	critical
118505	GLSA-201810-05：xkbcommon：多個弱點	Nessus	Gentoo Local Security Checks	2018/10/31	2022/1/31	high
118794	Ubuntu 18.04 LTS：libxkbcommon 弱點 (USN-3786-2)	Nessus	Ubuntu Local Security Checks	2018/11/7	2024/10/29	high
128206	Scientific Linux 安全性更新：SL7.x x86_64 上的 Xorg	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	critical
164608	Nutanix AOS：多個弱點 (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical
128206	Scientific Linux 安全更新：SL7.x x86_64 上的 X.org	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	critical
118505	GLSA-201810-05：xkbcommon：多个漏洞	Nessus	Gentoo Local Security Checks	2018/10/31	2022/1/31	high
118794	Ubuntu 18.04 LTS：libxkbcommon 漏洞 (USN-3786-2)	Nessus	Ubuntu Local Security Checks	2018/11/7	2024/10/29	high
164608	Nutanix AOS：多个漏洞 (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical

検出

プラグインの検索

critical

high

high

critical

high

high

critical

critical

critical

high

high

critical