It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1433 advisory.

    It was discovered that libX11 does not properly validate input coming from the server, causing     XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make     XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a     malicious X server or modify the data coming from one, could use this flaw to crash the application using     libX11, resulting in a denial of service.(CVE-2018-14598)

    An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and     XListFonts(). An attacker who can either configure a malicious X server or modify the data coming from one     could use this flaw to make the program crash or have other unspecified effects, caused by the memory     corruption.(CVE-2018-14599)

    An out of bounds write, limited to NULL bytes, was discovered in libX11 in functions XListExtensions() and     XGetFontPath(). The length field is considered as a signed value, which makes the library access memory     before the intended buffer. An attacker who can either configure a malicious X server or modify the data     coming from one could use this flaw to make the program crash or have other unspecified effects, caused by     the memory corruption.(CVE-2018-14600)

    An uncontrolled recursion flaw was found in libxkbcommon in the way it parses boolean expressions. A     specially crafted file provided to xkbcomp could crash the application. (CVE-2018-15853)

    Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were     desupported incorrectly. (CVE-2018-15854)

    Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL     pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an     xkb_geometry section was mishandled. (CVE-2018-15855)

    An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon     before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted     keymap files. (CVE-2018-15856)

    An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be     used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by     supplying a crafted keymap file. (CVE-2018-15857)

    Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon     before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by     supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)

    Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

    Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by     local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file with invalid virtual modifiers. (CVE-2018-15862)

    Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2     could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a     crafted keymap file with a no-op modmask expression. (CVE-2018-15863)

    Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used     by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap     file, because a map access attempt can occur for a map that was never created. (CVE-2018-15864)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : xorg-x11-server (ALAS-2020-1433)

critical Nessus Plugin ID 137090

Version 1.4