Alibaba Cloud Linux 3 : 0177: tigervnc (ALINUX3-SA-2026:0177)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Alibaba Cloud Linux Security Advisory ALINUX3-SA-2026:0177.
##

include('compat.inc');

if (description)
{
  script_id(324100);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/01");

  script_cve_id(
    "CVE-2026-50256",
    "CVE-2026-50257",
    "CVE-2026-50258",
    "CVE-2026-50259",
    "CVE-2026-50260",
    "CVE-2026-50261",
    "CVE-2026-50262",
    "CVE-2026-50263",
    "CVE-2026-50264"
  );

  script_name(english:"Alibaba Cloud Linux 3 : 0177: tigervnc (ALINUX3-SA-2026:0177)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Alibaba Cloud Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced
in the ALINUX3-SA-2026:0177 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-50256:
    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X
    server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font
    alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is
    1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the
    undersized stack buffer without further checks. This may be used to crash the server, or for privilege
    escalation if the X server runs as root.

    CVE-2026-50257:
    A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that
    sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would
    connect to the X server to set up a fence and await that fence, then a second X connection destroys the
    fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if
    the X server runs as root.

    CVE-2026-50258:
    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple
    stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-
    canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and
    trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash
    the server, or for privilege escalation if the X server runs as root.

    CVE-2026-50259:
    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks()
    declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function
    CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.
    This may be used to crash the server, or for privilege escalation if the X server runs as root.

    CVE-2026-50260:
    A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up
    multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those
    counters via a second client connection. This may be used to crash the server, or for privilege escalation
    if the X server runs as root.

    CVE-2026-50261:
    A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that
    sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second
    client connection while changing those counters. This may be used to crash the server, or for privilege
    escalation if the X server runs as root.

    CVE-2026-50262:
    An out-of-bounds read flaw was found in the X.Org X server and Xwayland in
    __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of
    bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but
    requires byte-swapped clients which is disabled by default.

    CVE-2026-50263:
    A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can
    trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to
    information disclosure.

    CVE-2026-50264:
    An out-of-bounds write flaw was found in the X.Org X server and Xwayland in
    DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and
    one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or
    for privilege escalation if the X server runs as root.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://mirrors.aliyun.com/alinux/3/cve/alinux3-sa-20260177.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50264");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:tigervnc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:tigervnc-icons");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:tigervnc-license");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:tigervnc-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:tigervnc-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:tigervnc-server-minimal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:tigervnc-server-module");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alibabacloud:alibaba_cloud_linux_3");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alibaba Cloud Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Alibaba/release", "Host/Alibaba/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Alibaba Cloud Linux' >!< os_product) audit(AUDIT_OS_NOT, 'Alibaba Cloud Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Alibaba Cloud Linux');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Alibaba Cloud Linux 3.x', 'Alibaba Cloud Linux ' + os_version);

if (!get_kb_item('Host/Alibaba/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Alibaba Cloud Linux', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'tigervnc-1.15.0-10.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-1.15.0-10.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-icons-1.15.0-10.al8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-license-1.15.0-10.al8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-selinux-1.15.0-10.al8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-server-1.15.0-10.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-server-1.15.0-10.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-server-minimal-1.15.0-10.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-server-minimal-1.15.0-10.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-server-module-1.15.0-10.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'tigervnc-server-module-1.15.0-10.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc');
}