Debian dla-4738 : xdmx - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4738. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(335006);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/13");

  script_cve_id(
    "CVE-2022-49737",
    "CVE-2025-26597",
    "CVE-2026-33999",
    "CVE-2026-34000",
    "CVE-2026-34001",
    "CVE-2026-34002",
    "CVE-2026-34003",
    "CVE-2026-50256",
    "CVE-2026-50257",
    "CVE-2026-50258",
    "CVE-2026-50259",
    "CVE-2026-50260",
    "CVE-2026-50261",
    "CVE-2026-50262",
    "CVE-2026-50263",
    "CVE-2026-50264"
  );
  script_xref(name:"IAVA", value:"2025-A-0135-S");
  script_xref(name:"IAVA", value:"2026-A-0351-S");
  script_xref(name:"IAVA", value:"2026-A-0548");

  script_name(english:"Debian dla-4738 : xdmx - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4738 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4738-1                [email protected]
    https://www.debian.org/lts/security/                     Arnaud Rebillout
    August 13, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : xorg-server
    Version        : 2:1.20.11-1+deb11u18
    CVE ID         : CVE-2022-49737 CVE-2026-33999 CVE-2026-34000 CVE-2026-34001
                     CVE-2026-34002 CVE-2026-34003 CVE-2026-50256 CVE-2026-50257
                     CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261
                     CVE-2026-50262 CVE-2026-50263 CVE-2026-50264
    Debian Bug     : 1081338 1138680

    Several vulnerabilities were discovered in the Xorg X server, which may
    result in privilege escalation if the X server is running privileged.

    CVE-2022-49737

        In X.Org X server 20.11 through 21.1.16, when a client application
        uses easystroke for mouse gestures, the main thread modifies various
        data structures used by the input thread without acquiring a lock,
        aka a race condition. In particular, AttachDevice in dix/devices.c
        does not acquire an input lock.

    CVE-2026-33999

        A flaw was found in the X.Org X server. This integer underflow
        vulnerability, specifically in the XKB compatibility map handling,
        allows an attacker with local or remote X11 server access to trigger
        a buffer read overrun. This can lead to memory-safety violations and
        potentially a denial of service (DoS) or other severe impacts.

    CVE-2026-34000

        A flaw was found in the X.Org X server. This out-of-bounds read
        vulnerability in the XKB geometry processing, specifically within the
        `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an
        attacker to read uninitialized or out-of-bounds memory. An attacker
        with a connection to the X11 server, either locally or remotely, can
        exploit this without user interaction. This could lead to the
        disclosure of memory contents or cause a denial of service by
        crashing the server.  Source

    CVE-2026-34001

        A flaw was found in the X.Org X server. This use-after-free
        vulnerability occurs in the XSYNC fence triggering logic,
        specifically within the miSyncTriggerFence() function. An attacker
        with access to the X11 server can exploit this without user
        interaction, leading to a server crash and potentially enabling
        memory corruption. This could result in a denial of service or
        further compromise of the system.

    CVE-2026-34002

        A flaw was found in the X.Org X server. This vulnerability, an
        out-of-bounds read, affects the XKB (X Keyboard Extension) modifier
        map handling. An attacker with access to the X11 server can exploit
        this by sending a malformed request, which causes the server to read
        beyond its intended memory boundaries. This can lead to the exposure
        of sensitive information or cause the server to crash, resulting in a
        denial of service.

    CVE-2026-34003

        A flaw was found in the X.Org X server's XKB key types request
        validation. A local attacker could send a specially crafted request
        to the X server, leading to an out-of-bounds memory access
        vulnerability. This could result in the disclosure of sensitive
        information or cause the server to crash, leading to a Denial of
        Service (DoS). In certain configurations, higher impact outcomes may
        be possible.

    CVE-2026-50256

        A stack-based buffer overflow flaw was found in the X.Org X server
        and Xwayland. A mismatch between the X server and the libXfont2
        library's maximum font name length can cause a stack buffer overflow
        during font alias resolution. The server allocates a 256 byte stack
        buffer but libXfont2's alias target name length is 1024 bytes. A font
        alias name between 257 and 1023 bytes causes the X server to copy
        that name into the undersized stack buffer without further checks.
        This may be used to crash the server, or for privilege escalation if
        the X server runs as root.

    CVE-2026-50257

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        miSyncDestroyFence(). A client that sets up multiple fence triggers
        can trigger a use-after-free function pointer call. An attacker would
        connect to the X server to set up a fence and await that fence, then
        a second X connection destroys the fence, causing the use-after-free.
        This may be used to crash the server, or for privilege escalation if
        the X server runs as root.

    CVE-2026-50258

        A stack-based buffer overflow flaw was found in the X.Org X server
        and Xwayland. The X server has multiple stack buffers sized
        XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not
        verify or clamp non-canonical key types to XkbMaxShiftLevel. A client
        can change key types to excessive shift levels and trigger stack
        overflows. This is caused by an incomplete fix of CVE-2025-26597.
        This may be used to crash the server, or for privilege escalation if
        the X server runs as root.

    CVE-2026-50259

        A stack-based buffer overflow flaw was found in the X.Org X server
        and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer
        mapWidths[256] indexed by key type index. The helper function
        CheckKeyTypes() writes to this buffer at a client-controlled offset,
        allowing a stack buffer overflow. This may be used to crash the
        server, or for privilege escalation if the X server runs as root.

    CVE-2026-50260

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        FreeCounter(). A client that sets up multiple SyncCounters and awaits
        on those triggers can trigger a use-after-free when destroying those
        counters via a second client connection. This may be used to crash
        the server, or for privilege escalation if the X server runs as root.

    CVE-2026-50261

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        SyncChangeCounter(). A client that sets up multiple SyncCounters can
        trigger a use-after-free when destroying those counters via a second
        client connection while changing those counters. This may be used to
        crash the server, or for privilege escalation if the X server runs as
        root.

    CVE-2026-50262

        An out-of-bounds read flaw was found in the X.Org X server and
        Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size
        validation check can read a client-controlled number of bytes,
        exceeding the request buffer, leading to information disclosure. A
        write path also exists but requires byte-swapped clients which is
        disabled by default.

    CVE-2026-50263

        A use-after-free flaw was found in the X.Org X server and Xwayland in
        CreateSaverWindow(). A client can trigger a use-after-free read after
        changing window attributes and forcing the screen saver, leading to
        information disclosure.

    CVE-2026-50264

        An out-of-bounds write flaw was found in the X.Org X server and
        Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that
        requests multiple DRI2BufferBackLeft attachments and one
        DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may
        be used to crash the server, or for privilege escalation if the X
        server runs as root.

    For Debian 12 bullseye, these problems have been fixed in version
    2:1.20.11-1+deb11u18.

    We recommend that you upgrade your xorg-server packages.

    For the detailed security status of xorg-server please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/xorg-server

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security-tracker.debian.org/tracker/source-package/xorg-server
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6c821d87");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-49737");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-26597");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-33999");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34000");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34001");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34002");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34003");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50256");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50257");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50258");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50259");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50260");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50261");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50262");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50263");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50264");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/xorg-server");
  script_set_attribute(attribute:"solution", value:
"Upgrade the xdmx packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-34002");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xdmx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xdmx-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xnest");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xorg-server-source");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xephyr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-core-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xserver-xorg-legacy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xvfb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xwayland");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'xdmx', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xdmx-tools', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xnest', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xorg-server-source', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xserver-common', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xserver-xephyr', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xserver-xorg-core', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xserver-xorg-core-udeb', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xserver-xorg-dev', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xserver-xorg-legacy', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xvfb', 'reference': '2:1.20.11-1+deb11u18'},
    {'release': '11.0', 'prefix': 'xwayland', 'reference': '2:1.20.11-1+deb11u18'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'xdmx / xdmx-tools / xnest / xorg-server-source / xserver-common / etc');
}