TencentOS Server 3: python-pillow (TSSA-2026:1434)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1434.
##

include('compat.inc');

if (description)
{
  script_id(379300);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/11");

  script_cve_id(
    "CVE-2026-96640",
    "CVE-2026-112391",
    "CVE-2026-112392",
    "CVE-2026-112397",
    "CVE-2026-112402",
    "CVE-2026-112405",
    "CVE-2026-112406",
    "CVE-2026-112892",
    "CVE-2026-112894",
    "CVE-2026-112895"
  );

  script_name(english:"TencentOS Server 3: python-pillow (TSSA-2026:1434)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1434 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-96640:
    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in
    src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references.
    When Image.save(..., format=PDF, append=True) processes an attacker-controlled existing PDF whose /Kids
    arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct
    pages. A compact malformed PDF can therefore create exponentially many page references and consume
    disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.

    CVE-2026-112391:
    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse
    without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and
    dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an
    application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or
    terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.

    CVE-2026-112392:
    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid
    image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while
    replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached.
    An attacker can supply or cause creation of a zero-size image to an application that applies a rank,
    median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version
    13.0.0.

    CVE-2026-112397:
    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory
    before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the
    native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can
    supply such an image to an application that applies a morphology operation. This can crash the process.
    This issue is fixed in version 13.0.0.

    CVE-2026-112402:
    Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when
    ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles
    Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST
    resampling. The output image allocation must succeed while the additional per-column lookup allocation
    fails, after which the error path deletes image storage that later cleanup releases again. An attacker who
    can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can
    crash the process and may corrupt memory. This issue is fixed in version 13.0.0.

    CVE-2026-112405:
    Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a
    null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point
    image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach
    this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such
    a first band. This causes a native process crash. This issue is fixed in version 13.0.0.

    CVE-2026-112406:
    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while
    rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in
    the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF.
    This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.

    CVE-2026-112892:
    Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small
    file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting
    expansion to the declared image size. An attacker can supply a crafted MSP image to an application that
    loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the
    decompression-bomb check. This issue is fixed in version 13.0.0.

    CVE-2026-112894:
    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF
    object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly
    rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-
    frame image, including a small APNG with a large declared frame count, to an application that converts it
    to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version
    13.0.0.

    CVE-2026-112895:
    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an
    existing PDF during an append operation. PdfParser follows page-tree child references without cycle or
    duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep
    or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-
    cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF
    to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError
    or consume excessive CPU and memory before output is written, causing denial of service. This issue is
    fixed in version 13.0.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261434.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-96640");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-112895");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:python-pillow");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'python-pillow-debuginfo-5.1.1-33.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python-pillow-debuginfo-5.1.1-33.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python-pillow-debugsource-5.1.1-33.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python-pillow-debugsource-5.1.1-33.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-5.1.1-33.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-5.1.1-33.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-debuginfo-5.1.1-33.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-debuginfo-5.1.1-33.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-devel-5.1.1-33.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-devel-5.1.1-33.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-doc-5.1.1-33.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-tk-5.1.1-33.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-tk-5.1.1-33.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-tk-debuginfo-5.1.1-33.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-pillow-tk-debuginfo-5.1.1-33.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-pillow-debuginfo / python-pillow-debugsource / python3-pillow / etc');
}