Debian dsa-6411 : aom-tools - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-6411. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(332088);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/05");

  script_cve_id(
    "CVE-2026-56208",
    "CVE-2026-56209",
    "CVE-2026-56210",
    "CVE-2026-56211"
  );

  script_name(english:"Debian dsa-6411 : aom-tools - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dsa-6411 advisory.

    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-6411-1                   [email protected]
    https://www.debian.org/security/                                  Aron Xu
    August 05, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : aom
    CVE ID         : CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211
    Debian Bug     : 1140428

    Multiple vulnerabilities were discovered in aom, the reference
    implementation of the AV1 video codec. All of them affect the encoder;
    applications that only decode AV1 video are not affected.

    CVE-2026-56208

        In look-ahead processing (LAP) mode the first-pass statistics buffer
        was sized from the configured lag-in-frames alone, leaving it shorter
        than the longest group of pictures the encoder may analyse. Together
        with an off-by-one in the number of frames considered, this allowed
        the encoder to read and write outside the allocation, resulting in
        denial of service or potentially the execution of arbitrary code.

    CVE-2026-56209, CVE-2026-56210, CVE-2026-56211

        The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec
        controls did not validate the supplied scalable video coding (SVC)
        layer identifiers against the number of layers actually configured.
        A negative or too large identifier led to an out-of-bounds read of
        the layer context array, an out-of-bounds write through the cyclic
        refresh map pointer, and potentially the execution of arbitrary
        code. Exploitation requires an application that allows an attacker
        to influence the encoder's SVC configuration.

    Additionally this update validates the configured number of spatial and
    temporal layers, which the affected version accepted without any range
    check.

    For the stable distribution (trixie), these problems have been fixed in
    version 3.12.1-1+deb13u1.

    We recommend that you upgrade your aom packages.

    For the detailed security status of aom please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/aom

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/aom");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-56208");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-56209");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-56210");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-56211");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/trixie/aom");
  script_set_attribute(attribute:"solution", value:
"Upgrade the aom-tools packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56209");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-56208");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:aom-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libaom-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libaom-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libaom3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(13)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 13.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '13.0', 'prefix': 'aom-tools', 'reference': '3.12.1-1+deb13u1'},
    {'release': '13.0', 'prefix': 'libaom-dev', 'reference': '3.12.1-1+deb13u1'},
    {'release': '13.0', 'prefix': 'libaom-doc', 'reference': '3.12.1-1+deb13u1'},
    {'release': '13.0', 'prefix': 'libaom3', 'reference': '3.12.1-1+deb13u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'aom-tools / libaom-dev / libaom-doc / libaom3');
}