EulerOS 2.0 SP12 : libpng (EulerOS-SA-2026-1400)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(302372);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/16");

  script_cve_id(
    "CVE-2025-64505",
    "CVE-2025-64506",
    "CVE-2025-66293",
    "CVE-2026-22695",
    "CVE-2026-22801"
  );
  script_xref(name:"IAVA", value:"2025-A-0908-S");
  script_xref(name:"IAVA", value:"2026-A-0030-S");

  script_name(english:"EulerOS 2.0 SP12 : libpng (EulerOS-SA-2026-1400)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability
    exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The
    vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image
    data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-
    bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read
    vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the
    simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha,
    RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter
    code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue
    has been patched in version 1.6.51.(CVE-2025-64506)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's
    simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid
    palette PNG images with partial transparency and gamma correction. The PNG files that trigger this
    vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the
    libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit
    output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
    This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng
    simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read
    when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535
    bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings
    on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-1400
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7b01e8db");
  script_set_attribute(attribute:"solution", value:
"Update the affected libpng packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22801");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libpng");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(12)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "libpng-1.6.38-1.h5.eulerosv2r12"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"12", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libpng");
}