{"id":137924,"date":"2025-06-21T23:12:01","date_gmt":"2025-06-21T21:12:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda"},"modified":"2025-06-21T23:12:01","modified_gmt":"2025-06-21T21:12:01","slug":"uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","title":{"rendered":"Zranitelnosti v knihovn\u011b libxml2, potenci\u00e1ln\u011b vedouc\u00ed k vykon\u00e1n\u00ed k\u00f3du","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V knihovn\u011b Libxml2, kterou vyv\u00edj\u00ed projekt GNOME a kter\u00e1 se pou\u017e\u00edv\u00e1 k anal\u00fdze obsahu ve form\u00e1tu XML, bylo zji\u0161t\u011bno 5 zranitelnost\u00ed, z nich\u017e dv\u011b mohou potenci\u00e1ln\u011b v\u00e9st k vykon\u00e1n\u00ed k\u00f3du p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00fdch extern\u00edch dat. Knihovna Libxml2 je \u0161iroce pou\u017e\u00edv\u00e1na v otev\u0159en\u00fdch projektech a nap\u0159\u00edklad je pou\u017eita jako z\u00e1vislost ve v\u00edce ne\u017e 800 bal\u00ed\u010dc\u00edch v distribuci Ubuntu. <\/p>\n

Prvn\u00ed zranitelnost (CVE-2025-6170) je zp\u016fsobena p\u0159ete\u010den\u00edm bufferu v implementaci interaktivn\u00ed shellov\u00e9 utility xmllint, kter\u00e1 se pou\u017e\u00edv\u00e1 k anal\u00fdze XML soubor\u016f. K p\u0159ete\u010den\u00ed doch\u00e1z\u00ed p\u0159i zpracov\u00e1n\u00ed velmi dlouh\u00fdch argument\u016f p\u0159\u00edkaz\u016f kv\u016fli absenci spr\u00e1vn\u00e9ho ov\u011b\u0159en\u00ed velikosti vstupn\u00edch dat p\u0159ed kop\u00edrov\u00e1n\u00edm dat funkc\u00ed strcpy(). K vyu\u017eit\u00ed t\u00e9to zranitelnosti mus\u00ed \u00fato\u010dn\u00edk m\u00edt mo\u017enost ovlivnit p\u0159\u00edkazy p\u0159ed\u00e1van\u00e9 utility xmllint. Oprava pro odstran\u011bn\u00ed zranitelnosti zat\u00edm nen\u00ed k dispozici. <\/p>\n

Druh\u00e1 zranitelnost (CVE-2025-6021) se vyskytuje v implementaci funkce xmlBuildQName() a vede k z\u00e1pisu dat mimo buffer kv\u016fli cel\u00e9mu \u010d\u00edseln\u00e9mu p\u0159ete\u010den\u00ed p\u0159i v\u00fdpo\u010dtu velikosti bufferu na z\u00e1klad\u011b prefixu a lok\u00e1ln\u00edho n\u00e1zvu. K vyu\u017eit\u00ed t\u00e9to zranitelnosti mus\u00ed \u00fato\u010dn\u00edk dos\u00e1hnout substituce sv\u00fdch dat do argument\u016f prefix a ncname p\u0159ed\u00e1van\u00fdch funkci xmlBuildQName(). Oprava pro tuto zranitelnost byla p\u0159ipravena. Oprava je sou\u010d\u00e1st\u00ed vyd\u00e1n\u00ed libxml2 2.14.4. Stav nov\u00e9 verze bal\u00ed\u010dku nebo p\u0159\u00edpravy opravy lze zkontrolovat na n\u00e1sleduj\u00edc\u00edch str\u00e1nk\u00e1ch (pokud str\u00e1nka nen\u00ed dostupn\u00e1, znamen\u00e1 to, \u017ee v\u00fdvoj\u00e1\u0159i distribuce se je\u0161t\u011b neza\u010dali zab\u00fdvat probl\u00e9mem): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo a Arch (1, 2). <\/p>\n

Zb\u00fdvaj\u00edc\u00ed t\u0159i probl\u00e9my vedou k hav\u00e1rii kv\u016fli p\u0159\u00edstupu k ji\u017e uvoln\u011bn\u00e9 oblasti pam\u011bti ve funkci xmlSchematronGetNode (CVE-2025-49794), dereferencov\u00e1n\u00ed null ukazatele ve funkci xmlXPathCompiledEval (CVE-2025-49795) a nespr\u00e1vn\u00e9mu zpracov\u00e1n\u00ed typ\u016f (Type Confusion) ve funkci xmlSchematronFormatReport (CVE-2025-49796). Pro odstran\u011bn\u00ed t\u011bchto zranitelnost\u00ed se zva\u017euje mo\u017enost odstran\u011bn\u00ed podpory jazyka ozna\u010dov\u00e1n\u00ed Schematron z libxml2. <\/p>\n

Je nutn\u00e9 zm\u00ednit, \u017ee v knihovn\u011b libxslt z\u016fst\u00e1vaj\u00ed t\u0159i neopraven\u00e9 zranitelnosti, kter\u00e9 nemaj\u00ed \u017e\u00e1dn\u00e9ho mainten\u00e9ra. Informace o t\u011bchto probl\u00e9mech zat\u00edm nebyly zve\u0159ejn\u011bny a jejich publikace je napl\u00e1nov\u00e1na na 9. \u010dervence, 13. \u010dervence a 6. srpna. Neopraven\u00e9 a ve\u0159ejn\u011b nezve\u0159ejn\u011bn\u00e9 zranitelnosti jsou tak\u00e9 zaznamen\u00e1ny v projektech souvisej\u00edc\u00edch s GNOME, jako jsou gvfs, libgxps, gdm, glib, GIMP a libsoup. <\/p>\n

Dopl\u0148uj\u00edc\u00ed informace: Mainten\u00e9r libxml2 ozn\u00e1mil, \u017ee nyn\u00ed bude zranitelnosti pova\u017eovat za b\u011b\u017en\u00e9 chyby, nebude je stav\u011bt jako prioritn\u00ed a opravovat je bude podle pot\u0159eby, p\u0159i\u010dem\u017e ihned zve\u0159ejn\u00ed informace o podstat\u011b zranitelnosti, ani\u017e by uvaloval embargo nebo d\u00e1val \u010das na odstran\u011bn\u00ed v extern\u00edch produktech.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Libxml2 \u0448\u0438\u0440\u043e\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 \u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Ubuntu. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-6170) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-137924","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v knihovn\u011b libxml2, potenci\u00e1ln\u011b vedouc\u00ed k vykon\u00e1n\u00ed k\u00f3du | ProHoster","description":"V knihovn\u011b Libxml2, kter\u00e1 je vyv\u00edjena projektem GNOME a pou\u017e\u00edv\u00e1 se k anal\u00fdze obsahu ve form\u00e1tu XML, bylo zji\u0161t\u011bno 5 zranitelnost\u00ed, z nich\u017e dv\u011b mohou potenci\u00e1ln\u011b v\u00e9st ke spu\u0161t\u011bn\u00ed k\u00f3du p\u0159i specifick\u00e9m zpracov\u00e1v\u00e1n\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libxml2, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-21T21:12:01+00:00","article:modified_time":"2025-06-21T21:12:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"137924","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:23:11","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:23:11","updated":"2026-01-23 13:23:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/137924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=137924"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/137924\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=137924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=137924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=137924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}