openSUSE 16 Security Update : loupe (openSUSE-SU-2026:21074-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21074-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(324050);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/01");

  script_cve_id("CVE-2025-58160");

  script_name(english:"openSUSE 16 Security Update : loupe (openSUSE-SU-2026:21074-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-
SU-2026:21074-1 advisory.

    This update for loupe fixes the following issue

    - CVE-2025-58160: tracing-subscriber: untrusted input containing ANSI escape sequences can lead to
    terminal
      manipulation (bsc#1249009).

    Changes for loupe:

    - Update to version 48.2:

     - Check if the is-hidden property is available before reading
     it.
     - Considerably increased speed for listing other images in
     folders, especially for remote locations. This allows for
     switching to other images to become available much quicker.
     - Fix panics, probably occuring when using an action like
     'copy', and then closing the window. The crash causes all
     other windows to close.
     - The creation date for images that don't provide a timezone
     was displayed as if the recorded date and time was in UTC.
     - Zooming in would not work via the zoom menu, if the resulting
     zoom state would still fit the image inside the window.

    - Update to version 48.1:

     - Crash when closing the window, probably in the exact moment
     when the animnation for hiding controls starts.
     - Editing does not work correctly if PNGs or JPEGs are already
     rotated via an Exif orientation entry before editing.
     - Printed pages don't contain anything or garbled output. This
     is a temporary workaround for
     <https://gitlab.gnome.org/GNOME/gtk/-/issues/7464>, using the
     cairo renderer for the rotation and scaling of the image in
     the print preparation.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1249009");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-58160");
  script_set_attribute(attribute:"solution", value:
"Update the affected loupe and / or loupe-lang packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-58160");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:loupe");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:loupe-lang");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'loupe-48.2-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'loupe-lang-48.2-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'loupe / loupe-lang');
}