TencentOS Server 3: vim (TSSA-2026:1147)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1147.
##

include('compat.inc');

if (description)
{
  script_id(365142);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-28420",
    "CVE-2026-52859",
    "CVE-2026-55892",
    "CVE-2026-59857",
    "CVE-2026-73072",
    "CVE-2026-73076",
    "CVE-2026-73078"
  );
  script_xref(name:"IAVA", value:"2026-A-0195-S");
  script_xref(name:"IAVA", value:"2026-A-0619");
  script_xref(name:"IAVA", value:"2026-A-0630-S");
  script_xref(name:"IAVA", value:"2026-A-0739-S");
  script_xref(name:"IAVA", value:"2026-A-0846");

  script_name(english:"TencentOS Server 3: vim (TSSA-2026:1147)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1147 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-28420:
    Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow
    WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining
    characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

    CVE-2026-52859:
    Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function
    in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken.
    For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it
    encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots  a
    base character plus five combining marks  the bundled libvterm returns the array without a terminating
    NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer
    reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger
    this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in
    version 9.2.0565.

    CVE-2026-55892:
    Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in
    src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes
    that apply to a word. The counter is bounded only by the trie structure itself; it is never checked
    against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A
    crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so
    the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the
    call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.

    CVE-2026-59857:
    Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of
    spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into
    a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to
    reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A
    boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based
    spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack
    frame and crash the editor. This issue is fixed in version 9.2.0725.

    CVE-2026-73072:
    Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses
    sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an
    SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes
    beyond a heap allocation. This issue is fixed in version 9.2.0846.

    CVE-2026-73076:
    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a
    crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen
    commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands,
    including operating-system commands invoked through :!, execute with the privileges of the user running
    Vim. This issue is fixed in version 9.2.0847.

    CVE-2026-73078:
    Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads
    netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu
    entries by interpolating attacker-controlled directory paths into executed :menu commands.
    s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to
    neutralize the | command separator or single quotes at five construction sites, allowing a crafted path
    browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is
    fixed in version 9.2.0840.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261147.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-73078");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:vim");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'vim-common-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-common-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-common-debuginfo-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-common-debuginfo-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-debuginfo-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-debuginfo-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-debugsource-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-debugsource-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-enhanced-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-enhanced-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-enhanced-debuginfo-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-enhanced-debuginfo-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-filesystem-8.0.1763-31.tl3.7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-minimal-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-minimal-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-minimal-debuginfo-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-minimal-debuginfo-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-X11-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-X11-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-X11-debuginfo-8.0.1763-31.tl3.7', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'vim-X11-debuginfo-8.0.1763-31.tl3.7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'vim-X11 / vim-X11-debuginfo / vim-common / etc');
}