Ghostscript Heap Buffer Overflow in JPEG 2000 Output Adapter (sjpx_openjpeg.c)

#!/usr/bin/env bash
# CVE-2026-39919 Checker — Ghostscript Heap Buffer Overflow (sjpx_openjpeg.c)
# Checks whether the installed Ghostscript is patched against CVE-2026-39919.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"

# --- Detect package manager and get installed version ---
get_pkg_version() {
  if command -v dpkg-query &>/dev/null; then
    dpkg-query -W -f='${Version}' ghostscript 2>/dev/null || echo ""
  elif command -v rpm &>/dev/null; then
    rpm -q --qf '%{VERSION}-%{RELEASE}' ghostscript 2>/dev/null || echo ""
  elif command -v apk &>/dev/null; then
    apk info -e ghostscript 2>/dev/null | head -1 || echo ""
  else
    echo ""
  fi
}

# --- Check if Ghostscript is installed ---
if ! command -v gs &>/dev/null; then
  echo "PATCHED — Ghostscript is not installed on this host."
  exit 0
fi

GS_VERSION=$(gs --version 2>/dev/null || echo "unknown")
PKG_VERSION=$(get_pkg_version)

echo "Ghostscript binary version: $GS_VERSION"
echo "Package version: ${PKG_VERSION:-not determined}"

# --- Known-patched distro package versions ---
# Ubuntu 22.04
if echo "$PKG_VERSION" | grep -qE '9\.55\.0.*ubuntu5\.1[4-9]'; then
  RESULT="PATCHED"
# Ubuntu 24.04
elif echo "$PKG_VERSION" | grep -qE '10\.02\.1.*ubuntu7\.(9|[1-9][0-9])'; then
  RESULT="PATCHED"
# Ubuntu 26.04
elif echo "$PKG_VERSION" | grep -qE '10\.06\.0.*ubuntu1\.[1-9]'; then
  RESULT="PATCHED"
# Debian 12
elif echo "$PKG_VERSION" | grep -qE '10\.0\.0.*deb12u([8-9]|[1-9][0-9])'; then
  RESULT="PATCHED"
# Debian 13
elif echo "$PKG_VERSION" | grep -qE '10\.05\.1.*deb13u([2-9]|[1-9][0-9])'; then
  RESULT="PATCHED"
# RHEL/Alma/Rocky — check if errata is applied
elif echo "$PKG_VERSION" | grep -qE 'el[89]_[0-9]+\.[1-9]' && rpm -q --changelog ghostscript 2>/dev/null | grep -qi 'CVE-2026-39919'; then
  RESULT="PATCHED"
fi

# --- Upstream version check (covers source installs) ---
if [ "$RESULT" = "UNKNOWN" ]; then
  MAJOR=$(echo "$GS_VERSION" | cut -d. -f1)
  MINOR=$(echo "$GS_VERSION" | cut -d. -f2)
  PATCH=$(echo "$GS_VERSION" | cut -d. -f3)
  if [ "$MAJOR" -gt 10 ] 2>/dev/null; then
    RESULT="PATCHED"
  elif [ "$MAJOR" -eq 10 ] && [ "$MINOR" -gt 7 ] 2>/dev/null; then
    RESULT="PATCHED"
  elif [ "$MAJOR" -eq 10 ] && [ "$MINOR" -eq 8 ] && [ "${PATCH:-0}" -ge 0 ] 2>/dev/null; then
    RESULT="PATCHED"
  elif [ "$MAJOR" -eq 10 ] && [ "$MINOR" -le 7 ] 2>/dev/null; then
    RESULT="VULNERABLE"
  elif [ "$MAJOR" -eq 9 ] && [ "$MINOR" -ge 21 ] 2>/dev/null; then
    RESULT="VULNERABLE"
  fi
fi

# --- Also check ImageMagick policy (compensating control) ---
POLICY_BLOCKS_PDF="no"
for pfile in /etc/ImageMagick-*/policy.xml /usr/local/etc/ImageMagick-*/policy.xml; do
  if [ -f "$pfile" ] && grep -q 'pattern="PDF"' "$pfile" && grep -q 'rights="none"' "$pfile"; then
    POLICY_BLOCKS_PDF="yes"
    break
  fi
done 2>/dev/null

echo "ImageMagick PDF delegate blocked: $POLICY_BLOCKS_PDF"

# --- Output ---
if [ "$RESULT" = "PATCHED" ]; then
  echo "PATCHED — Ghostscript version is fixed or includes the backported patch."
  exit 0
elif [ "$RESULT" = "VULNERABLE" ]; then
  if [ "$POLICY_BLOCKS_PDF" = "yes" ]; then
    echo "VULNERABLE (mitigated) — Ghostscript is unpatched but ImageMagick PDF delegate is blocked."
  else
    echo "VULNERABLE — Ghostscript $GS_VERSION is affected by CVE-2026-39919. Patch immediately."
  fi
  exit 1
else
  echo "UNKNOWN — Could not determine patch status. Verify manually."
  exit 2
fi