Debian dla-4819 : libapache2-mod-php8.2 - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4819. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(362914);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/04");

  script_cve_id(
    "CVE-2025-1218",
    "CVE-2025-14181",
    "CVE-2026-6103",
    "CVE-2026-91765",
    "CVE-2026-91766",
    "CVE-2026-91767",
    "CVE-2026-91768",
    "CVE-2026-91769",
    "CVE-2026-92842",
    "CVE-2026-93682"
  );

  script_name(english:"Debian dla-4819 : libapache2-mod-php8.2 - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4819 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4819-1                [email protected]
    https://www.debian.org/lts/security/                       Guilhem Moulin
    October 05, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : php8.2
    Version        : 8.2.34-1~deb12u1
    CVE ID         : CVE-2025-1218 CVE-2025-14181 CVE-2026-6103 CVE-2026-91765
                     CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769
                     CVE-2026-92842 CVE-2026-93682

    Multiple security issues were found in PHP, a widely-used open source
    general purpose scripting language, which could result in in denial of
    service, information disclosure, privilege escalation, incorrect
    validation of TLS certificates or bypass of access control restrictions.

    CVE-2025-1218

        Various packet overreads in were found in the mysqlnd wire protocol,
        which may lead to denial of service when connecting to an untrusted
        or compromised MySQL server.  Applications that only connect to
        trusted database servers are not exposed.

    CVE-2025-14181

        The SOAP HTTP client guards its response buffer growth with a check
        that relies on signed integer overflow, which may lead to denial of
        service or memory corruption depending on the heap layout and the
        compiler used to build PHP.

    CVE-2026-6103

        An integer overflow vulnerability was discovered in
        phar_tar_number(), which allows TAR archive entry injection.

    CVE-2026-91765

        The cleanup_xml_node() function in the SOAP XML parser was found to
        recurse once per XML nesting level with no depth limit, which may
        allow denial of service via crafted SOAP request.

    CVE-2026-91766

        The http:// stream wrapper was found to leak credential upon
        redirects to another host/port or scheme downgrade, which may lead
        to information disclosure or privilege escalation.

    CVE-2026-91767

         Mohamed Sayed discovered that a client connecting over TLS to a
         server presenting a crafted wildcard CN could cause an
         out-of-bounds read of unbounded length during hostname
         verification, leading to denial of service.

    CVE-2026-91768

        The IPv6 branch of the FastCGI client access check was found to
        compare only the first 12 bytes of a 16-byte IPv6 address, so
        `listen.allowed_clients` maches on a /96 prefix instead of the exact
        address, which may lead to access control bypass by an attacker who
        can source an address sharing its first 96 bits with an allowed one.

    CVE-2026-91769

        TLS peer verification was found to violate RFC 6125, and falls back
        to Common Name validation after subjectAltName mismatch.

    CVE-2026-92842

        A out-of-bounds read in the convert.* stream filters when the
        `line-break-chars` option contains NUL.

    CVE-2026-93682

        Ilia Alshanetsky discovered a out-of-bounds read in the HTTP stream
        wrapper when following a redirect with an empty Location header.

    GHSA-ch8v-r6jh-4vvr

        Khashayar Fereidani discovered that php_filter_encode_url() did not
        initialize the last entry of its  256-entry lookup table.


    For Debian 12 bookworm, these problems have been fixed in version
    8.2.34-1~deb12u1.

    We recommend that you upgrade your php8.2 packages.

    For the detailed security status of php8.2 please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.2

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/php8.2");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-1218");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-14181");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6103");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-91765");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-91766");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-91767");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-91768");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-91769");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-92842");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-93682");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/php8.2");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libapache2-mod-php8.2 packages.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-91768");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libapache2-mod-php8.2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libphp8.2-embed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-bz2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-cgi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-enchant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-fpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-gmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-interbase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-intl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-opcache");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-phpdbg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-pspell");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-readline");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-sqlite3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-sybase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-tidy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-xsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php8.2-zip");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'libapache2-mod-php8.2', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'libphp8.2-embed', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-bcmath', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-bz2', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-cgi', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-cli', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-common', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-curl', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-dba', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-dev', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-enchant', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-fpm', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-gd', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-gmp', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-imap', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-interbase', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-intl', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-ldap', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-mbstring', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-mysql', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-odbc', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-opcache', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-pgsql', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-phpdbg', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-pspell', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-readline', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-snmp', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-soap', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-sqlite3', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-sybase', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-tidy', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-xml', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-xsl', 'reference': '8.2.34-1~deb12u1'},
    {'release': '12.0', 'prefix': 'php8.2-zip', 'reference': '8.2.34-1~deb12u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libapache2-mod-php8.2 / libphp8.2-embed / php8.2 / php8.2-bcmath / etc');
}