TencentOS Server 3: gimp:2.8 (TSSA-2026:0972)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0972.
##

include('compat.inc');

if (description)
{
  script_id(342619);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");

  script_cve_id(
    "CVE-2026-18301",
    "CVE-2026-18303",
    "CVE-2026-18304",
    "CVE-2026-18305",
    "CVE-2026-18306",
    "CVE-2026-18307",
    "CVE-2026-58380",
    "CVE-2026-66758"
  );
  script_xref(name:"IAVA", value:"2026-A-0402");

  script_name(english:"TencentOS Server 3: gimp:2.8 (TSSA-2026:0972)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0972 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-18301:
    A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability within the
    `read_channel_data` function during PSD (Photoshop Document) file parsing by enticing a user to open a
    specially crafted PSD file. This could lead to arbitrary code execution in the context of the current
    process.

    CVE-2026-18303:
    A flaw was found in GIMP. This vulnerability, a stack-based buffer overflow in the TIF file parsing
    component, allows a remote attacker to execute arbitrary code. User interaction is required, as the target
    must open a specially crafted malicious TIF file. The issue stems from insufficient validation of user-
    supplied data length before copying it to a buffer, leading to potential code execution in the context of
    the current process.

    CVE-2026-18304:
    A flaw was found in GIMP. This vulnerability allows a remote attacker to execute arbitrary code by
    tricking a user into opening a specially crafted TIF file. The issue arises from improper validation of
    user-supplied data during TIF file parsing, which can lead to an integer overflow before memory
    allocation. Successful exploitation could result in the attacker executing code in the context of the
    current process.

    CVE-2026-18305:
    A flaw was found in GIMP, an image manipulation program. This vulnerability allows a remote attacker to
    execute arbitrary code on an affected system. Exploitation requires user interaction, where the target
    must open a specially crafted TIF (Tagged Image File Format) file. The flaw occurs during TIF file parsing
    due to improper validation of user-supplied data, which can lead to an integer overflow and enable the
    attacker to run malicious code.

    CVE-2026-18306:
    A flaw was found in GIMP. This vulnerability, an integer overflow within the parsing of SGI (Silicon
    Graphics Image) files, allows a remote attacker to execute arbitrary code. Exploitation requires user
    interaction, where the target must open a specially crafted malicious SGI file. Successful exploitation
    could lead to the attacker executing code in the context of the current user's process.

    CVE-2026-18307:
    A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the TIF file parsing component
    allows a remote attacker to execute arbitrary code. User interaction is required, as the target must open
    a specially crafted malicious TIF file. Successful exploitation can lead to arbitrary code execution in
    the context of the current process.

    CVE-2026-58380:
    A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the
    pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer
    due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially
    resulting in denial of service or arbitrary code execution.

    CVE-2026-66758:
    A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates
    memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both
    values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based
    buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio
    subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to
    arbitrary code execution or a denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260972.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-58380");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:gimp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:pygobject2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:pygtk2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:python2-pycairo");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'gimp-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-debuginfo-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-debuginfo-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-debugsource-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-debugsource-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-devel-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-devel-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-devel-tools-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-devel-tools-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-devel-tools-debuginfo-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-devel-tools-debuginfo-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-libs-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-libs-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-libs-debuginfo-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'gimp-libs-debuginfo-2.8.22-26.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'pygobject2-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-codegen-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-codegen-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-debuginfo-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-debuginfo-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-debugsource-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-debugsource-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-devel-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-devel-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-doc-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygobject2-doc-2.28.7-5.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-codegen-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-codegen-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-debuginfo-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-debuginfo-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-debugsource-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-debugsource-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-devel-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-devel-2.24.0-25.module+el8.10.0+803+c4684d9d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'pygtk2-doc-2.24.0-25.module+el8.10.0+803+c4684d9d', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-cairo-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-cairo-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-cairo-debuginfo-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-cairo-debuginfo-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-cairo-devel-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-cairo-devel-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-pycairo-debugsource-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python2-pycairo-debugsource-1.16.3-7.module+el8.10.0+720+f6e66bb9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'gimp / gimp-debuginfo / gimp-debugsource / etc');
}