EulerOS 2.0 SP13 : libpng (EulerOS-SA-2026-1283)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(301612);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/10");

  script_cve_id("CVE-2025-66293", "CVE-2026-22695", "CVE-2026-22801");
  script_xref(name:"IAVA", value:"2025-A-0908-S");
  script_xref(name:"IAVA", value:"2026-A-0030-S");

  script_name(english:"EulerOS 2.0 SP13 : libpng (EulerOS-SA-2026-1283)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng
    simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read
    when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535
    bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings
    on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the
    libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit
    output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
    This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's
    simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid
    palette PNG images with partial transparency and gamma correction. The PNG files that trigger this
    vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-1283
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4e8d3c16");
  script_set_attribute(attribute:"solution", value:
"Update the affected libpng packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22801");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libpng");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(13)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "libpng-1.6.38-2.h3.eulerosv2r13"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"13", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libpng");
}