Debian dla-4737 : xnest - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4737. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(335005);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/13");

  script_cve_id(
    "CVE-2022-49737",
    "CVE-2025-26597",
    "CVE-2026-50256",
    "CVE-2026-50257",
    "CVE-2026-50258",
    "CVE-2026-50259",
    "CVE-2026-50260",
    "CVE-2026-50261",
    "CVE-2026-50262",
    "CVE-2026-50263",
    "CVE-2026-50264"
  );

  script_name(english:"Debian dla-4737 : xnest - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4737 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4737-1                [email protected]
    https://www.debian.org/lts/security/                     Arnaud Rebillout
    August 13, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : xorg-server
    Version        : 2:21.1.7-3+deb12u13
    CVE ID         : CVE-2022-49737 CVE-2026-50256 CVE-2026-50257 CVE-2026-50258
                     CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262
                     CVE-2026-50263 CVE-2026-50264
    Debian Bug     : 1081338 1138680

    Several vulnerabilities were discovered in the Xorg X server, which may
    result in privilege escalation if the X server is running privileged.

    CVE-2022-49737

        In X.Org X server 20.11 through 21.1.16, when a client application
        uses easystroke for mouse gestures, the main thread modifies various
        data structures used by the input thread without acquiring a lock,
        aka a race condition. In particular, AttachDevice in dix/devices.c
        does not acquire an input lock.

    CVE-2026-50256

        A stack-based buffer overflow flaw was found in the X.Org X server
        and Xwayland. A mismatch between the X server and the libXfont2
        library's maximum font name length can cause a stack buffer overflow
        during font alias resolution. The server allocates a 256 byte stack
        buffer but libXfont2's alias target name length is 1024 bytes. A font
        alias name between 257 and 1023 bytes causes the X server to copy
        that name into the undersized stack buffer without further checks.
        This may be used to crash the server, or for privilege escalation if
        the X server runs as root.

    CVE-2026-50257

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        miSyncDestroyFence(). A client that sets up multiple fence triggers
        can trigger a use-after-free function pointer call. An attacker would
        connect to the X server to set up a fence and await that fence, then
        a second X connection destroys the fence, causing the use-after-free.
        This may be used to crash the server, or for privilege escalation if
        the X server runs as root.

    CVE-2026-50258

        A stack-based buffer overflow flaw was found in the X.Org X server
        and Xwayland. The X server has multiple stack buffers sized
        XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not
        verify or clamp non-canonical key types to XkbMaxShiftLevel. A client
        can change key types to excessive shift levels and trigger stack
        overflows. This is caused by an incomplete fix of CVE-2025-26597.
        This may be used to crash the server, or for privilege escalation if
        the X server runs as root.

    CVE-2026-50259

        A stack-based buffer overflow flaw was found in the X.Org X server
        and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer
        mapWidths[256] indexed by key type index. The helper function
        CheckKeyTypes() writes to this buffer at a client-controlled offset,
        allowing a stack buffer overflow. This may be used to crash the
        server, or for privilege escalation if the X server runs as root.

    CVE-2026-50260

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        FreeCounter(). A client that sets up multiple SyncCounters and awaits
        on those triggers can trigger a use-after-free when destroying those
        counters via a second client connection. This may be used to crash
        the server, or for privilege escalation if the X server runs as root.

    CVE-2026-50261

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        SyncChangeCounter(). A client that sets up multiple SyncCounters can
        trigger a use-after-free when destroying those counters via a second
        client connection while changing those counters. This may be used to
        crash the server, or for privilege escalation if the X server runs as
        root.

    CVE-2026-50262

        An out-of-bounds read flaw was found in the X.Org X server and
        Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size
        validation check can read a client-controlled number of bytes,
        exceeding the request buffer, leading to information disclosure. A
        write path also exists but requires byte-swapped clients which is
        disabled by default.

    CVE-2026-50263

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        CreateSaverWindow(). A client can trigger a use-after-free read after
        changing window attributes and forcing the screen saver, leading to
        information disclosure.

    CVE-2026-50264

        An out-of-bounds write flaw was found in the X.Org X server and
        Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that
        requests multiple DRI2BufferBackLeft attachments and one
        DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may
        be used to crash the server, or for privilege escalation if the X
        server runs as root.

    For Debian 12 bookworm, these problems have been fixed in version
    2:21.1.7-3+deb12u13.

    We recommend that you upgrade your xorg-server packages.

    For the detailed security status of xorg-server please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/xorg-server

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security-tracker.debian.org/tracker/source-package/xorg-server
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6c821d87");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-49737");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-26597");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50256");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50257");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50258");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50259");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50260");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50261");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50262");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50263");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50264");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/xorg-server");
  script_set_attribute(attribute:"solution", value:
"Upgrade the xnest packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-26597");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xnest");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xorg-server-source");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xephyr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-core-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-legacy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xvfb");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'xnest', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xorg-server-source', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xserver-common', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xserver-xephyr', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xserver-xorg-core', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xserver-xorg-core-udeb', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xserver-xorg-dev', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xserver-xorg-legacy', 'reference': '2:21.1.7-3+deb12u13'},
    {'release': '12.0', 'prefix': 'xvfb', 'reference': '2:21.1.7-3+deb12u13'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'xnest / xorg-server-source / xserver-common / xserver-xephyr / etc');
}