Backport 0.8.2 for a CVE update

[Timo Aaltonen]

[Impact]
0.8.2 has completed the fuzzing work started in 0.8.1, so backport the package from cosmic to fix these CVE's:

CVE-2018-15853 CVE-2018-15854 CVE-2018-15855 CVE-2018-15856
CVE-2018-15857 CVE-2018-15858 CVE-2018-15859 CVE-2018-15861
CVE-2018-15862 CVE-2018-15863 CVE-2018-15864.

upstream NEWS:

libxkbcommon 0.8.2 - 2018-08-05
==================

- Fix various problems found with fuzzing (see commit messages for
  more details):

    - Fix a few NULL-dereferences, out-of-bounds access and undefined behavior
      in the XKB text format parser.

libxkbcommon 0.8.1 - 2018-08-03
==================

- Fix various problems found in the meson build (see commit messages for more
  details):

    - Fix compilation on Darwin.

    - Fix compilation of the x11 tests and demos when XCB is installed in a
      non-standard location.

    - Fix xkbcommon-x11.pc missing the Requires specification.

- Fix various problems found with fuzzing and Coverity (see commit messages for
  more details):

    - Fix stack overflow in the XKB text format parser when evaluating boolean
      negation.

    - Fix NULL-dereferences in the XKB text format parser when some unsupported
      tokens appear (the tokens are still parsed for backward compatibility).

    - Fix NULL-dereference in the XKB text format parser when parsing an
      xkb_geometry section.

    - Fix an infinite loop in the Compose text format parser on some inputs.

    - Fix an invalid free() when using multiple keysyms.

- Replace the Unicode characters for the leftanglebracket and rightanglebracket
  keysyms from the deprecated LEFT/RIGHT-POINTING ANGLE BRACKET to
  MATHEMATICAL LEFT/RIGHT ANGLE BRACKET.

- Reject out-of-range Unicode codepoints in xkb_keysym_to_utf8 and
  xkb_keysym_to_utf32.

[Test case]
install the update, check that nothing breaks wrt keyboard handling

[Regression potential]
slim, this has been in cosmic for some time already, and upstream specifically asked to backport this to stable releases

There are some other changes to the packaging, but these are harmless and won't regress anything.

[Leonidas S. Barbosa (leosilvab)]

Hi Timo,

Are you planning to update only for bionic or will you do this also for trusty and xenial?
Asking that because I was/am planning to put that update in my stack for xenial and trusty.

[]'s

[Robie Basak (racb)]

This is in the SRU queue but it looks like the security pocket might be a better target? I asked Timo to liase with the security team to get a decision on that.

[Timo Aaltonen (tjaalton)]

leo: feel free to take over trusty/xenial, I don't have anything ready for them

and if this needs to be handled differently, then that's fine too

[Leonidas S. Barbosa (leosilvab)]

Is there any POC for check CVE-2018-15856? Trusty hasn't the file affected, but I'm wondering if it handles the same thing and is vulnerable and the only way to check this would be if we have any POC.

Tks!

[Timo Aaltonen (tjaalton)]

Not that I know of..

[Robie Basak (racb)]

An upload of libxkbcommon to bionic-proposed has been rejected from the upload queue for the following reason: "Please use the security pocket/process or else explain why this is using the SRU process over the security process in the SRU information provided in the bug.".

[Timo Aaltonen (tjaalton)]

leo: feel free to handle all updates via the security pocket(s), as I have no permission to upload there (AIUI).

[Sebastien Bacher (seb128)]

The CVEs have been fixed in a security upload
https://launchpad.net/ubuntu/+source/libxkbcommon/0.8.0-1ubuntu0.1

[Timo Aaltonen (tjaalton)]

but not via a backport, so marking this as wontfix :)