EulerOS 2.0 SP15 : expat (EulerOS-SA-2026-3908)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364091);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/08");

  script_cve_id(
    "CVE-2026-56131",
    "CVE-2026-56132",
    "CVE-2026-56403",
    "CVE-2026-56404",
    "CVE-2026-56405",
    "CVE-2026-56406",
    "CVE-2026-56407",
    "CVE-2026-56408",
    "CVE-2026-56409",
    "CVE-2026-56410",
    "CVE-2026-56411",
    "CVE-2026-56412"
  );
  script_xref(name:"IAVA", value:"2026-A-0650-S");

  script_name(english:"EulerOS 2.0 SP15 : expat (EulerOS-SA-2026-3908)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was
    present in XML_Parse.(CVE-2026-56406)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity
    textLen.(CVE-2026-56407)

    xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION
    declarations.(CVE-2026-56411)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call
    depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-
    free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)

    xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is
    used.(CVE-2026-56409)

    libexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold
    backing array reallocation is mishandled when there is data-structure sharing across
    parsers.(CVE-2026-56132)

    libexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)

    xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)

    libexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers
    in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219
    situation).(CVE-2026-56131)

    libexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3908
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0c9c2881");
  script_set_attribute(attribute:"solution", value:
"Update the affected expat packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56412");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-56405");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:expat");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:expat-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:expat-help");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "expat-2.5.0-7.h21510.13.eulerosv2r15",
  "expat-devel-2.5.0-7.h21510.13.eulerosv2r15",
  "expat-help-2.5.0-7.h21510.13.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "expat");
}