EulerOS Virtualization 2.11.1 : libpng (EulerOS-SA-2026-3430)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348031);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2025-28162",
    "CVE-2025-28164",
    "CVE-2025-64505",
    "CVE-2025-64506",
    "CVE-2025-64720",
    "CVE-2025-65018",
    "CVE-2025-66293",
    "CVE-2026-22695",
    "CVE-2026-22801",
    "CVE-2026-25646",
    "CVE-2026-33416",
    "CVE-2026-33636",
    "CVE-2026-34757"
  );
  script_xref(name:"IAVA", value:"2025-A-0908-S");
  script_xref(name:"IAVA", value:"2026-A-0030-S");
  script_xref(name:"IAVA", value:"2026-A-0135-S");
  script_xref(name:"IAVA", value:"2026-A-0272-S");
  script_xref(name:"IAVA", value:"2026-A-0322-S");

  script_name(english:"EulerOS Virtualization 2.11.1 : libpng (EulerOS-SA-2026-3430)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's
    simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid
    palette PNG images with partial transparency and gamma correction. The PNG files that trigger this
    vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read
    vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the
    simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha,
    RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter
    code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue
    has been patched in version 1.6.51.(CVE-2025-64506)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read
    vulnerability exists in png_image_read_composite when processing palette images with
    PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly
    applies background compositing during premultiplication, violating the invariant component  alpha 
    257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow
    vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit
    interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond
    allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability
    exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The
    vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image
    data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-
    bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service
    via png_create_read_struct() function.(CVE-2025-28164)

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service
    via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually
    leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the
    png_set_quantize() API function. When the function is called with no histogram and the number of colors in
    the palette is more than twice the maximum supported by the user's display, certain palettes will cause
    the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer.
    The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is
    fixed in 1.6.55.(CVE-2026-25646)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng
    simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read
    when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535
    bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings
    on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the
    libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit
    output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
    This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write
    exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows
    to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels
    remain. Because the implementation works backward from the end of the row, the final iteration
    dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the
    same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG
    input if Neon is enabled. Version 1.6.56 fixes the issue.(CVE-2026-33636)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE`
    each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across
    two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng
    1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS`
    sets `png_ptr-trans_alpha = info_ptr-trans_alpha` (256-byte buffer) and `png_set_PLTE` sets
    `info_ptr-palette = png_ptr-palette` (768-byte buffer). In both cases, calling `png_free_data` (with
    `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr`
    pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to
    the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both
    functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes
    the issue.(CVE-2026-33416)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from
    png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same
    png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the
    replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer,
    which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata)
    or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This
    vulnerability is fixed in 1.6.57.(CVE-2026-34757)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3430
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?45c2d223");
  script_set_attribute(attribute:"solution", value:
"Update the affected libpng packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25646");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libpng");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.11.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.11.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.11.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "libpng-1.6.37-2.h10.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libpng");
}