Debian dla-4709 : gir1.2-poppler-0.18 - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4709. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(331517);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/31");

  script_cve_id(
    "CVE-2025-43718",
    "CVE-2025-43903",
    "CVE-2025-50420",
    "CVE-2025-52885",
    "CVE-2025-52886",
    "CVE-2026-10118"
  );

  script_name(english:"Debian dla-4709 : gir1.2-poppler-0.18 - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4709 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4709-1                [email protected]
    https://www.debian.org/lts/security/                       Guilhem Moulin
    July 31, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : poppler
    Version        : 20.09.0-3.1+deb11u3 22.12.0-2+deb12u3
    CVE ID         : CVE-2025-43718 CVE-2025-43903 CVE-2025-50420 CVE-2025-52885
                     CVE-2025-52886 CVE-2026-10118
    Debian Bug     : 1103545 1108784 1110463 1117046 1117853 1138708

    Multiple vulnerabilities were discovered in poppler, a PDF rendering
    library, which could result in signature forgery, information
    disclosure, denial of service, or potentially the execution of arbitrary
    code.

    The following security issues have been identified (and fixed) in poppler
    as shipped in Debian bullseye and Debian bookworm.

    CVE-2025-43903

        It was discovered signatures with non-empty encapsulated content
        (typically adbe.pkcs7.sha1) were not correctly verified, thereby
        allowing trivial signature forgery.

    CVE-2025-50420

        An infinite recursion issue was discovered in the pdfseparate(1)
        utility, which may cause denial of service via crafted PDF input
        file.

    CVE-2025-52886

        Kevin Backhouse discovered an integer overflow issue, which may lead
        to use-after-free via crafted PDF input file.

    For Debian 12 bookworm, these problems have been fixed in version
    22.12.0-2+deb12u3.

    In addition, the following issues have been fixed in the poppler version
    as shipped in Debian bullseye (for bookworm, these issues were already
    fixed in 22.12.0-2+deb12u2 from DSA-6334-1):

    CVE-2025-43718

        It was discovered that crafted PDF files containing deeply nested
        structures within the metadata could lead to Denial of Service.

    CVE-2025-52885

        Antonio Morales discovered a use-after-free issue, which may lead to
        arbitrary code execution via crafted PDF input files.

    CVE-2026-10118

        An integer overflow issue was discovered in tilingPatternFill, which
        may lead to arbitrary code execution via crafted PDF input files.

    For Debian 11 bullseye, these problems have been fixed in version
    20.09.0-3.1+deb11u3.

    We recommend that you upgrade your poppler packages.

    For the detailed security status of poppler please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/poppler

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/poppler");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-43718");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-43903");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-50420");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-52885");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-52886");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-10118");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/poppler");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/poppler");
  script_set_attribute(attribute:"solution", value:
"Upgrade the gir1.2-poppler-0.18 packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-43903");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-52885");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gir1.2-poppler-0.18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-cpp-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-cpp0v5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-glib-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-glib-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-glib8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-private-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-qt5-1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-qt5-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-qt6-3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler-qt6-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler102");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpoppler126");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:poppler-utils");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'gir1.2-poppler-0.18', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-cpp-dev', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-cpp0v5', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-dev', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-glib-dev', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-glib-doc', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-glib8', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-private-dev', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-qt5-1', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler-qt5-dev', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'libpoppler102', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '11.0', 'prefix': 'poppler-utils', 'reference': '20.09.0-3.1+deb11u3'},
    {'release': '12.0', 'prefix': 'gir1.2-poppler-0.18', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-cpp-dev', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-cpp0v5', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-dev', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-glib-dev', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-glib-doc', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-glib8', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-private-dev', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-qt5-1', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-qt5-dev', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-qt6-3', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler-qt6-dev', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'libpoppler126', 'reference': '22.12.0-2+deb12u3'},
    {'release': '12.0', 'prefix': 'poppler-utils', 'reference': '22.12.0-2+deb12u3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_NOTE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'gir1.2-poppler-0.18 / libpoppler-cpp-dev / libpoppler-cpp0v5 / etc');
}