{"id":102350,"date":"2021-11-21T15:36:45","date_gmt":"2021-11-21T13:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim"},"modified":"2021-11-21T15:36:45","modified_gmt":"2021-11-21T13:36:45","slug":"uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim","title":{"rendered":"Zranitelnosti v LibreCAD, Ruby, TensorFlow, Mailman a Vim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
T\u0159i zranitelnosti ve voln\u00e9m syst\u00e9mu automatizovan\u00e9ho projektov\u00e1n\u00ed LibreCAD a knihovn\u011b libdxfrw, kter\u00e9 umo\u017e\u0148uj\u00ed iniciovat \u0159\u00edzen\u00e9 p\u0159ete\u010den\u00ed vyrovn\u00e1vac\u00ed pam\u011bti a potenci\u00e1ln\u011b dos\u00e1hnout proveden\u00ed vlastn\u00edho k\u00f3du p\u0159i otev\u00edr\u00e1n\u00ed speci\u00e1ln\u011b p\u0159ipraven\u00fdch soubor\u016f ve form\u00e1tech DWG a DXF. Probl\u00e9my byly zat\u00edm odstran\u011bny pouze ve form\u011b z\u00e1plat (CVE-2021-21898, CVE-2021-21899, CVE-2021-21900).\n
Zranitelnost (CVE-2021-41817) v metod\u011b Date.parse, kter\u00e1 je poskytov\u00e1na ve standardn\u00ed knihovn\u011b jazyka Ruby. Nedostatky v regul\u00e1rn\u00edch v\u00fdrazech pou\u017e\u00edvan\u00fdch k anal\u00fdze dat v metod\u011b Date.parse mohou b\u00fdt vyu\u017eity k proveden\u00ed DoS \u00fatok\u016f, kter\u00e9 vedou k po\u017e\u00edv\u00e1n\u00ed zna\u010dn\u00fdch prost\u0159edk\u016f CPU a spot\u0159eb\u011b pam\u011bti p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b p\u0159ipraven\u00fdch dat.\n
Zranitelnost v platform\u011b strojov\u00e9ho u\u010den\u00ed TensorFlow (CVE-2021-41228), kter\u00e1 umo\u017e\u0148uje proveden\u00ed vlastn\u00edho k\u00f3du p\u0159i zpracov\u00e1n\u00ed dat \u00fato\u010dn\u00edka pomoc\u00ed n\u00e1stroje saved_model_cli, p\u0159edan\u00fdch p\u0159es parametr «—input_examples». Probl\u00e9m je zp\u016fsoben pou\u017eit\u00edm extern\u00edch dat p\u0159i vol\u00e1n\u00ed k\u00f3du funkc\u00ed «eval». Probl\u00e9m byl odstran\u011bn ve verz\u00edch TensorFlow 2.7.0, TensorFlow 2.6.1, TensorFlow 2.5.2 a TensorFlow 2.4.4.\n
Zranitelnost (CVE-2021-43331) v syst\u00e9mu pro spr\u00e1vu e-mailov\u00fdch zpr\u00e1v GNU Mailman, zp\u016fsoben\u00e1 nespr\u00e1vn\u00fdm zpracov\u00e1n\u00edm n\u011bkter\u00fdch typ\u016f URL. Probl\u00e9m umo\u017e\u0148uje proveden\u00ed JavaScriptov\u00e9ho k\u00f3du prost\u0159ednictv\u00edm specifikace speci\u00e1ln\u011b p\u0159ipraven\u00e9ho URL na str\u00e1nce s nastaven\u00edm. V Mailman byla tak\u00e9 odhalena dal\u0161\u00ed zranitelnost (CVE-2021-43332), kter\u00e1 umo\u017e\u0148uje u\u017eivateli s pr\u00e1vem moder\u00e1tora zvolit heslo administr\u00e1tora. Probl\u00e9my byly odstran\u011bny ve verzi Mailman 2.1.36.\n
S\u00e9rie zranitelnost\u00ed v textov\u00e9m editoru Vim, kter\u00e9 mohou v\u00e9st k p\u0159ete\u010den\u00ed vyrovn\u00e1vac\u00ed pam\u011bti a potenci\u00e1ln\u011b k proveden\u00ed k\u00f3du \u00fato\u010dn\u00edka p\u0159i otev\u00edr\u00e1n\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00fdch soubor\u016f pomoc\u00ed mo\u017enosti «-S» (CVE-2021-3903, CVE-2021-3872, CVE-2021-3927, CVE-2021-3928, opravy — 1, 2, 3, 4). <\/ul>\n