Mageia: Security Advisory (MGASA-2023-0255)

# SPDX-FileCopyrightText: 2023 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.10.2023.0255");
  script_cve_id("CVE-2023-25433", "CVE-2023-26965", "CVE-2023-26966", "CVE-2023-2908", "CVE-2023-3316", "CVE-2023-3618");
  script_tag(name:"creation_date", value:"2023-09-11 14:57:02 +0000 (Mon, 11 Sep 2023)");
  script_version("2024-02-02T05:06:10+0000");
  script_tag(name:"last_modification", value:"2024-02-02 05:06:10 +0000 (Fri, 02 Feb 2024)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2023-07-20 17:16:44 +0000 (Thu, 20 Jul 2023)");

  script_name("Mageia: Security Advisory (MGASA-2023-0255)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2023 Greenbone AG");
  script_family("Mageia Linux Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/mageia_linux", "ssh/login/release", re:"ssh/login/release=MAGEIA9");

  script_xref(name:"Advisory-ID", value:"MGASA-2023-0255");
  script_xref(name:"URL", value:"https://advisories.mageia.org/MGASA-2023-0255.html");
  script_xref(name:"URL", value:"https://bugs.mageia.org/show_bug.cgi?id=32117");
  script_xref(name:"URL", value:"https://ubuntu.com/security/notices/USN-6229-1");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'libtiff' package(s) announced via the MGASA-2023-0255 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"A null pointer dereference issue was found in Libtiff's tif_dir.c file.
This issue may allow an attacker to pass a crafted TIFF image file to the
tiffcp utility which triggers a runtime error that causes undefined
behavior. This will result in an application crash, eventually leading to
a denial of service. (CVE-2023-2908)

A NULL pointer dereference in TIFFClose() is caused by a failure to open
an output file (non-existent path or a path that requires permissions like
/dev/null) while specifying zones. (CVE-2023-3316)

A vulnerability was found in SourceCodester Resort Management System 1.0.
It has been declared as problematic. Affected by this vulnerability is an
unknown functionality. The manipulation of the argument page leads to
cross site scripting. The attack can be launched remotely. The exploit has
been disclosed to the public and may be used. (CVE-2023-3618)

libtiff 4.5.0 is vulnerable to Buffer Overflow in
/libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after
rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.
(CVE-2023-25433)

loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based
use after free via a crafted TIFF image. (CVE-2023-26965)

libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff
reads a corrupted little-endian TIFF file and specifies the output to be
big-endian. (CVE-2023-26966)");

  script_tag(name:"affected", value:"'libtiff' package(s) on Mageia 9.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "MAGEIA9") {

  if(!isnull(res = isrpmvuln(pkg:"lib64tiff-devel", rpm:"lib64tiff-devel~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"lib64tiff-static-devel", rpm:"lib64tiff-static-devel~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"lib64tiff6", rpm:"lib64tiff6~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libtiff", rpm:"libtiff~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libtiff-devel", rpm:"libtiff-devel~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libtiff-progs", rpm:"libtiff-progs~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libtiff-static-devel", rpm:"libtiff-static-devel~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libtiff6", rpm:"libtiff6~4.5.1~1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);