Amazon Linux 2023 : tigervnc, tigervnc-icons, tigervnc-license (ALAS2023-2026-1892)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-1892.
##

include('compat.inc');

if (description)
{
  script_id(322085);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/22");

  script_cve_id(
    "CVE-2026-50256",
    "CVE-2026-50257",
    "CVE-2026-50258",
    "CVE-2026-50259",
    "CVE-2026-50260",
    "CVE-2026-50261",
    "CVE-2026-50262",
    "CVE-2026-50263",
    "CVE-2026-50264"
  );

  script_name(english:"Amazon Linux 2023 : tigervnc, tigervnc-icons, tigervnc-license (ALAS2023-2026-1892)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1892 advisory.

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X
    server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font
    alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is
    1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the
    undersized stack buffer without further checks. This may be used to crash the server, or for privilege
    escalation if the X server runs as root. (CVE-2026-50256)

    A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that
    sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would
    connect to the X server to set up a fence and await that fence, then a second X connection destroys the
    fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if
    the X server runs as root. (CVE-2026-50257)

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple
    stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-
    canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and
    trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash
    the server, or for privilege escalation if the X server runs as root. (CVE-2026-50258)

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks()
    declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function
    CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.
    This may be used to crash the server, or for privilege escalation if the X server runs as root.
    (CVE-2026-50259)

    A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up
    multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those
    counters via a second client connection. This may be used to crash the server, or for privilege escalation
    if the X server runs as root. (CVE-2026-50260)

    A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that
    sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second
    client connection while changing those counters. This may be used to crash the server, or for privilege
    escalation if the X server runs as root. (CVE-2026-50261)

    Multiple issues have been found in the X server and Xwayland implementations published by X.Org for which
    we are releasing security fixes for in xorg-server-21.1.23 and xwayland-24.1.12. (CVE-2026-50262)

    A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can
    trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to
    information disclosure. (CVE-2026-50263)

    An out-of-bounds write flaw was found in the X.Org X server and Xwayland in
    DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and
    one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or
    for privilege escalation if the X server runs as root. (CVE-2026-50264)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-1892.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50256.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50257.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50258.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50259.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50260.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50261.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50262.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50263.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50264.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update tigervnc --releasever 2023.12.20260622' or
  or 'dnf update --advisory ALAS2023-2026-1892 --releasever 2023.12.20260622' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50264");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-icons");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-license");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-server-minimal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-server-minimal-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-server-module");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tigervnc-server-module-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'tigervnc-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-debugsource-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-debugsource-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-icons-1.14.1-3.amzn2023.0.6', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-license-1.14.1-3.amzn2023.0.6', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-selinux-1.14.1-3.amzn2023.0.6', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-minimal-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-minimal-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-minimal-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-minimal-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-module-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-module-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-module-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tigervnc-server-module-debuginfo-1.14.1-3.amzn2023.0.6', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tigervnc / tigervnc-debuginfo / tigervnc-debugsource / etc");
}