NewStart CGSL MAIN 7.02 : libpng Multiple Vulnerabilities (NS-SA-2026-0100)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2026-0100. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343581);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/08");

  script_cve_id(
    "CVE-2025-64505",
    "CVE-2025-64506",
    "CVE-2025-64720",
    "CVE-2025-65018",
    "CVE-2025-66293",
    "CVE-2026-3713",
    "CVE-2026-22801",
    "CVE-2026-25646",
    "CVE-2026-33416",
    "CVE-2026-33636",
    "CVE-2026-34757"
  );
  script_xref(name:"IAVA", value:"2025-A-0908-S");
  script_xref(name:"IAVA", value:"2026-A-0030-S");
  script_xref(name:"IAVA", value:"2026-A-0135-S");
  script_xref(name:"IAVA", value:"2026-A-0272-S");
  script_xref(name:"IAVA", value:"2026-A-0322-S");

  script_name(english:"NewStart CGSL MAIN 7.02 : libpng Multiple Vulnerabilities (NS-SA-2026-0100)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 7.02, has libpng packages installed that are affected by multiple
vulnerabilities:

  - A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function
    do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the
    argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The
    exploit has been published and may be used. The project was informed of the problem early through an issue
    report but has not responded yet. (CVE-2026-3713)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the
    png_set_quantize() API function. When the function is called with no histogram and the number of colors in
    the palette is more than twice the maximum supported by the user's display, certain palettes will cause
    the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer.
    The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is
    fixed in 1.6.55. (CVE-2026-25646)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability
    exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The
    vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image
    data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-
    bounds memory access. This issue has been patched in version 1.6.51. (CVE-2025-64505)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read
    vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the
    simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha,
    RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter
    code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue
    has been patched in version 1.6.51. (CVE-2025-64506)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read
    vulnerability exists in png_image_read_composite when processing palette images with
    PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly
    applies background compositing during premultiplication, violating the invariant component  alpha  257
    required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2026-0100");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-64505");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-64506");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-64720");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-65018");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-66293");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-22801");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-25646");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-33416");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-33636");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-34757");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-3713");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL libpng packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-3713");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-25646");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-25646");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libpng");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libpng-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libpng-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libpng-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libpng-static");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libpng-tools");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s7\.02")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 7.02');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 7.02': [
    'libpng-1.6.40-8.zncgsl7.1',
    'libpng-core-1.6.40-8.zncgsl7.1',
    'libpng-devel-1.6.40-8.zncgsl7.1',
    'libpng-doc-1.6.40-8.zncgsl7.1',
    'libpng-static-1.6.40-8.zncgsl7.1',
    'libpng-tools-1.6.40-8.zncgsl7.1'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libpng');
}