openSUSE 16: libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc (openSUSE-SU-2026:21703-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21703-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(342116);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/01");

  script_cve_id(
    "CVE-2026-6464",
    "CVE-2026-6469",
    "CVE-2026-6470",
    "CVE-2026-6471",
    "CVE-2026-14662",
    "CVE-2026-14663",
    "CVE-2026-14664",
    "CVE-2026-14666",
    "CVE-2026-14668",
    "CVE-2026-14669",
    "CVE-2026-14670",
    "CVE-2026-14671",
    "CVE-2026-14672",
    "CVE-2026-14673",
    "CVE-2026-14676",
    "CVE-2026-14677",
    "CVE-2026-14678",
    "CVE-2026-14679",
    "CVE-2026-14680",
    "CVE-2026-14681",
    "CVE-2026-15741",
    "CVE-2026-15742",
    "CVE-2026-16238",
    "CVE-2026-16239",
    "CVE-2026-16241",
    "CVE-2026-18024",
    "CVE-2026-18408",
    "CVE-2026-19385"
  );
  script_xref(name:"IAVB", value:"2026-B-0238");

  script_name(english:"openSUSE 16: libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc (openSUSE-SU-2026:21703-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21703-1 advisory.

    - CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands
    (bsc#1275046).
    - CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).
    - CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).
    - CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).
    - CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).
    - CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from
    cleartext
      (bsc#1275002).
    - CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).
    - CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
    - CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read
      (bsc#1275066).
    - CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).
    - CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).
    - CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).
    - CVE-2026-14672:  observable response discrepancy with non-default `scram_iterations` provides user
    existence
      oracle (bsc#1275062).
    - CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).
    - CVE-2026-14676: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060).
    - CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).
    - CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).
    - CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory
    (bsc#1275057).
    - CVE-2026-14680: type confusion via internal arguments (bsc#1275056).
    - CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
    - CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).
    - CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound
    (bsc#1275053).
    - CVE-2026-16238: type confusion in `pg_restore_attribute_stats()` executes arbitrary code (bsc#1275052).
    - CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).
    - CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
    - CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).
    - CVE-2026-18408: `psql` `\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in
    `psql`
      client (bsc#1275048).
    - CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).

    Changes for postgresql18:

    - Let `llvmjit-devel` require the `llc` and `clang` binaries to fix build of extensions on SLE-16 and
    newer.
    - Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
    - Update to version 18.6:
      * https://www.postgresql.org/docs/18/release-18-6.html
      * https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275001");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275002");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275042");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275043");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275044");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275046");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275047");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275048");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275049");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275050");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275051");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275052");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275053");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275054");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275055");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275056");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275057");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275058");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275059");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275060");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275061");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275062");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275063");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275064");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275065");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275066");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275067");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275068");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14662");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14663");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14664");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14666");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14668");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14669");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14670");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14671");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14672");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14673");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14676");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14677");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14678");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14679");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14680");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-14681");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-15741");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-15742");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-16238");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-16239");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-16241");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-18024");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-18408");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-19385");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-6464");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-6469");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-6470");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-6471");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-18408");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-19385");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-contrib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-devel-mini");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-llvmjit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-llvmjit-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-plperl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-plpython");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-pltcl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-server-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql18-test");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'libecpg6-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libpq5-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-contrib-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-devel-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-devel-mini-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-llvmjit-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-llvmjit-devel-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-plperl-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-plpython-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-pltcl-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-server-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-server-devel-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'postgresql18-test-18.6-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc');
}