AlmaLinux 9.2 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776329620)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(360815);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2025-7039",
    "CVE-2025-14512",
    "CVE-2026-0988",
    "CVE-2026-1484",
    "CVE-2026-1485",
    "CVE-2026-1489"
  );
  script_xref(name:"CLSA", value:"2026:1776329620");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776329620)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1776329620 advisory.

  - A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via
    an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing
    malicious file or remote filesystem attribute values. (CVE-2025-14512)

  - A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds
    memory access, allowing an attacker to potentially perform path traversal or access private temporary file
    content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths
    and access unauthorized data. The core issue stems from insufficient validation of file path lengths
    during temporary file operations. (CVE-2025-7039)

  - A flaw was found in glib. Missing validation of offset and count parameters in the
    g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When
    specially crafted values are provided, this overflow results in an incorrect size being passed to
    memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service
    (DoS). (CVE-2026-0988)

  - A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to
    incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries.
    This can cause memory writes outside the allocated buffer. Applications that process untrusted or
    extremely large Base64 input using GLib may crash or behave unpredictably. (CVE-2026-1484)

  - A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because
    the length of a header line is stored in a signed integer, which can lead to integer wraparound for very
    large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a
    local user to install or process a specially crafted treemagic file, which can lead to local denial of
    service or application instability. (CVE-2026-1485)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1776329620.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0753e79a");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1776329620");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1776329620.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-1489");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'glib2-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'glib2-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'glib2-devel-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'glib2-devel-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'glib2-doc-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'glib2-static-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'glib2-static-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'glib2-tests-2.68.4-6.el9.tuxcare.els6', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests');
}