EulerOS 2.0 SP13 : libXfont2 (EulerOS-SA-2026-4058)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364796);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-44950",
    "CVE-2026-56001",
    "CVE-2026-56002",
    "CVE-2026-56003",
    "CVE-2026-59679"
  );

  script_name(english:"EulerOS 2.0 SP13 : libXfont2 (EulerOS-SA-2026-4058)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected
by the following vulnerabilities :

    A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in
    libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using
    authenticated X clients to execute code within the X server.(CVE-2026-56003)

    A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a
    malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to
    properly validate the total size of the incoming data, leading to an overwrite of memory beyond the
    intended buffer. If the X server runs as a privileged user, this could result in privilege escalation,
    allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to
    a denial of service, causing the system to crash.(CVE-2026-44950)

    A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows
    attackers authenticated as X client to execute code within the X server.(CVE-2026-56002)

    A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font
    server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client
    incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privilege
    escalation if the X server runs with root privileges, or a denial of service (crash) if it runs as an
    unprivileged user.(CVE-2026-59679)

    A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size
    could be used by attackers able to access the X Server to execute code within the X server
    cont(CVE-2026-56001)

Tenable has extracted the preceding description block directly from the EulerOS libXfont2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-4058
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa1b8040");
  script_set_attribute(attribute:"solution", value:
"Update the affected libXfont2 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56003");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-44950");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libXfont2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libXfont2-help");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(13)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "libXfont2-2.0.5-3.h3.eulerosv2r13",
  "libXfont2-help-2.0.5-3.h3.eulerosv2r13"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"13", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libXfont2");
}