TencentOS Server 3: tesseract (TSSA-2026:1431)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1431.
##

include('compat.inc');

if (description)
{
  script_id(379311);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/11");

  script_cve_id(
    "CVE-2026-88047",
    "CVE-2026-88048",
    "CVE-2026-88049",
    "CVE-2026-88051",
    "CVE-2026-88052",
    "CVE-2026-88053"
  );

  script_name(english:"TencentOS Server 3: tesseract (TSSA-2026:1431)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1431 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-88047:
    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in
    src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses
    std::istream::operator>>(char*) to extract a whitespace-delimited token into a fixed 61-byte stack buffer
    without setting a stream width. The 100-byte line buffer can carry a token of up to 99 characters, so a
    token longer than 60 characters writes up to 39 attacker-controlled bytes past the buffer during
    TessBaseAPI::Init of the legacy engine, causing stack corruption, denial of service, and potentially
    control-flow hijacking on affected standard-library implementations. Builds using Apple's libc++ C++20
    bounded array overload are incidentally protected, while typical libstdc++ builds remain affected. No
    fixed release is available as of this review.

    CVE-2026-88048:
    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in
    src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the
    weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrix.cpp
    writes w.dim1() results into temp_line, which is sized from no_, and reads w.dim2() minus one inputs from
    curr_input, which is sized from ni_. A crafted .traineddata NT_SOFTMAX layer can therefore use
    inconsistent dimensions to cause a heap out-of-bounds write and read on the default LSTM engine, resulting
    in heap corruption, a crash, information disclosure, or potentially controlled corruption. No fixed
    release is available as of this review.

    CVE-2026-88049:
    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added
    bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but
    left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In LSTM::Forward in
    src/lstm/lstm.cpp, source_ is sized from the independently deserialized na_ field while the
    WriteTimeStepPart count is ns_, which comes from the CI gate WeightMatrix dim1() value. A crafted NT_LSTM
    layer can make ns_ much larger than na_, causing a heap out-of-bounds write during the first recognition
    step on the default LSTM engine and resulting in heap corruption, a crash, or potentially controlled
    corruption. No fixed release is available as of this review.

    CVE-2026-88051:
    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of
    GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and
    size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the
    backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with
    version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when
    fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds
    write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed
    release is available as of this review.

    CVE-2026-88052:
    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in
    src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked
    index into the unichars vector. unichar_insert_backwards_compatible can leave the vector unchanged for an
    empty, duplicate, or already-encodable representation, causing id to become larger than unichars.size().
    Subsequent set_* calls and the write to unichars[id].properties.enabled then write UNICHAR_PROPERTIES
    beyond the vector during initialization in both the default LSTM and legacy engines, causing heap
    corruption, a crash, or potentially controlled corruption. No fixed release is available as of this
    review.

    CVE-2026-88053:
    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in
    src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP
    component of a crafted .traineddata file and uses those values as loop bounds without validating them
    against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into
    fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an
    oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before
    OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release
    is available as of this review.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261431.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-88053");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:tesseract");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'tesseract-4.1.1-7.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tesseract-4.1.1-7.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tesseract-debuginfo-4.1.1-7.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tesseract-debuginfo-4.1.1-7.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tesseract-debugsource-4.1.1-7.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tesseract-debugsource-4.1.1-7.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tesseract-devel-4.1.1-7.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tesseract-devel-4.1.1-7.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tesseract / tesseract-debuginfo / tesseract-debugsource / etc');
}