CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791184271)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(368081);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id("CVE-2026-55191", "CVE-2026-55192", "CVE-2026-55564");
  script_xref(name:"CLSA", value:"2026:1791184271");

  script_name(english:"CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791184271)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS7:CLSA-2026:1791184271 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that
    negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in
    libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can
    supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value,
    causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using
    the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution
    through attacker-influenced heap corruption. This issue is fixed in version 3.27.0. (CVE-2026-55191)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder
    backends can return YUV planes sized from the bitstream without comparing the decoded width and height to
    the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an
    AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing
    yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in
    libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the
    client. This issue is fixed in version 3.27.0. (CVE-2026-55192)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get
    function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater
    than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in
    update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254,
    reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client
    and may disclose adjacent heap data. This issue is fixed in version 3.27.0. (CVE-2026-55564)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1791184271.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2c0542b0");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1791184271");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1791184271.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55191");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 7', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'freerdp-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-devel-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'freerdp-libs-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'aarch64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'i686', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libwinpr-devel-2.1.1-5.0.9.el7_9.tuxcare.els3', 'cpu':'x86_64', 'el_string':'el7_9', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel');
}