CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784898733)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(359864);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2025-66628",
    "CVE-2026-24485",
    "CVE-2026-25985",
    "CVE-2026-25989",
    "CVE-2026-28494",
    "CVE-2026-28691",
    "CVE-2026-28693",
    "CVE-2026-61857",
    "CVE-2026-61861",
    "CVE-2026-61863",
    "CVE-2026-61870"
  );
  script_xref(name:"CLSA", value:"2026:1784898733");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784898733)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2026:1784898733 advisory.

  - ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9
    and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its
    ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header
    and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where
    size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping
    around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later
    operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version
    7.1.2-10. (CVE-2025-66628)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to
    versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage()
    function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to
    become unresponsive and continuously consume CPU resources, ultimately leading to system resource
    exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch. (CVE-2026-24485)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to
    versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to
    attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40
    contain a patch. (CVE-2026-25985)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to
    versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary
    check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions
    7.1.2-15 and 6.9.13-40 contain a patch. (CVE-2026-25989)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to
    versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick's morphology kernel parsing
    functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via
    memcpy without bounds checking, resulting in stack corruption. This vulnerability is fixed in 7.1.2-16 and
    6.9.13-41. (CVE-2026-28494)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1784898733.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a063fdd9");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1784898733");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1784898733.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-61870");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-61861");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'ImageMagick-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ImageMagick-c++-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ImageMagick-c++-devel-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ImageMagick-devel-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ImageMagick-djvu-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ImageMagick-doc-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ImageMagick-libs-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ImageMagick-perl-6.9.13.50-1.el8.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc');
}