{"id":184011,"date":"2026-10-27T11:40:44","date_gmt":"2026-10-27T09:40:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimosti-v-rust-bibliotekah-zip-rs-i-librsvg"},"modified":"2026-10-27T11:40:49","modified_gmt":"2026-10-27T09:40:49","slug":"vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","title":{"rendered":"Zranitelnosti v Rust knihovn\u00e1ch zip-rs a librsvg","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V knihovn\u011b zip-rs napsan\u00e9 v jazyce Rust, kter\u00e1 m\u00e1 p\u0159ibli\u017en\u011b 10 milion\u016f sta\u017een\u00ed t\u00fddn\u011b, byla zji\u0161t\u011bna zranitelnost (CVE-2026-115905), je\u017e umo\u017e\u0148uje vytv\u00e1\u0159en\u00ed archiv\u016f, kter\u00e9 se tv\u00e1\u0159\u00ed jako ne\u0161kodn\u00e9, av\u0161ak po rozbalen\u00ed mohou obsahovat dal\u0161\u00ed soubory, kter\u00e9 nebyly p\u016fvodn\u011b zobrazeny v seznamu. Soubory mohou b\u00fdt um\u00edst\u011bny v archivu mimo strukturu «Central Directory», co\u017e znamen\u00e1, \u017ee p\u0159i prohl\u00ed\u017een\u00ed seznamu soubor\u016f se zobraz\u00ed jedno obsahy, ale p\u0159i rozbalen\u00ed p\u0159es API ZipStreamReader se extrahuj\u00ed jin\u00e9 soubory. Probl\u00e9m je klasifikov\u00e1n jako velmi z\u00e1va\u017en\u00fd, s \u00farovn\u00ed nebezpe\u010d\u00ed 10 z 10. Zranitelnost byla opravena ve verzi zip-rs 9.0.5.<\/p>\n

Zranitelnost je zp\u016fsobena pou\u017e\u00edv\u00e1n\u00edm r\u016fzn\u00fdch hlavi\u010dek p\u0159i libovoln\u00e9m p\u0159\u00edstupu k archivu pomoc\u00ed API ZipArchive a p\u0159i extrakci dat v re\u00e1ln\u00e9m \u010dase pomoc\u00ed API ZipStreamReader. Handler ZipArchive se spol\u00e9h\u00e1 na hlavi\u010dku CDFH (Central Directory File Header), zat\u00edmco ZipStreamReader p\u0159i extrakci soubor\u016f pova\u017euje hlavi\u010dku LFH (Local File Header) za prioritn\u011bj\u0161\u00ed, ani\u017e by synchronizoval duplicitn\u00ed metadata.<\/p>\n

Zranitelnost m\u016f\u017ee b\u00fdt vyu\u017eita k obch\u00e1zen\u00ed e-mailov\u00fdch filtr\u016f, antivirov\u00fdch skener\u016f a dal\u0161\u00edch bezpe\u010dnostn\u00edch syst\u00e9m\u016f. \u00dato\u010dn\u00edk m\u016f\u017ee um\u00edstit do viditeln\u00e9 \u010d\u00e1sti archivu dokument nebo obr\u00e1zek a do skryt\u00e9 um\u00edstit spustiteln\u00fd soubor s malwarem, kter\u00fd nebude detekov\u00e1n antivirem, ale bude ulo\u017een na disk p\u0159i rozbalen\u00ed u\u017eivateli. Mezi p\u0159\u00edklady pat\u0159\u00ed \u00fatoky na mikroservisy, SaaS platformy a syst\u00e9my kontejnerov\u00e9 izolace, kdy p\u0159i rozbalov\u00e1n\u00ed v adres\u00e1\u0159\u00edch s pracovn\u00edmi projekty ne\u0161kodn\u00e9 archivy, jako jsou soubory styl\u016f, textov\u00e9 soubory nebo obr\u00e1zky, mohou p\u0159epsat skripty a spustiteln\u00e9 soubory.<\/p>\n

D\u00e1le je t\u0159eba zm\u00ednit zranitelnost (CVE-2026-96889) v knihovn\u011b librsvg, kterou vyv\u00edj\u00ed projekt GNOME v jazyce Rust. Knihovna se pou\u017e\u00edv\u00e1 v GTK a aplikac\u00edch GNOME pro vykreslov\u00e1n\u00ed SVG a je tak\u00e9 sou\u010d\u00e1st\u00ed popul\u00e1rn\u00edho bal\u00ed\u010dku NPM sharp, kter\u00fd m\u00e1 80 milion\u016f sta\u017een\u00ed t\u00fddn\u011b a kter\u00fd je z\u00e1vislost\u00ed t\u00e9m\u011b\u0159 11 tis\u00edc projekt\u016f. Zranitelnost umo\u017e\u0148uje prov\u00e1d\u011bn\u00ed vlastn\u00edho k\u00f3du p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00fdch SVG obr\u00e1zk\u016f. Probl\u00e9m byl odstran\u011bn ve verz\u00edch librsvg 2.56.6, 2.60.3, 2.62.4 a 2.63.1, stejn\u011b jako v bal\u00ed\u010dku NPM sharp 0.35.5. Mezi posti\u017een\u00fdmi projekty se ocitla platforma PeerTube (z\u00e1vislost byla aktualizov\u00e1na v dne\u0161n\u00edm vyd\u00e1n\u00ed PeerTube 8.3.2).<\/p>\n

Pro anal\u00fdzu XML zna\u010dkov\u00e1n\u00ed pou\u017e\u00edvan\u00e9ho v SVG souborech se v librsvg vyu\u017e\u00edvaj\u00ed funkce z C knihovny libxml2. Zranitelnost je zp\u016fsobena t\u00edm, \u017ee p\u0159i p\u0159\u00edtomnosti vno\u0159en\u00fdch XML struktur Xincludes v SVG, kter\u00e9 zahrnuj\u00ed duplikuj\u00edc\u00ed se prvky s opakuj\u00edc\u00edmi se n\u00e1zvy, dojde k p\u0159\u00edstupu do pam\u011bti po jej\u00edm uvoln\u011bn\u00ed. Chyba nast\u00e1v\u00e1, proto\u017ee knihovna librsvg uvol\u0148uje pam\u011b\u0165 pro XML prvky, kter\u00e9 jsou st\u00e1le pou\u017e\u00edv\u00e1ny v parseru libxml2.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zip-rs, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043e\u043a\u043e\u043b\u043e 10 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-115905), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0430\u0440\u0445\u0438\u0432\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c\u0438, \u043d\u043e \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0438\u0437 \u043d\u0438\u0445 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435, \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043d\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435, \u0444\u0430\u0439\u043b\u044b. \u0424\u0430\u0439\u043b\u044b \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432 \u0430\u0440\u0445\u0438\u0432\u0435 \u0432\u043d\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b «Central Directory», \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u043f\u0440\u0438 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0435 \u0441\u043f\u0438\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184011","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v Rust knihovn\u00e1ch zip-rs a librsvg | ProHoster","description":"V knihovn\u011b zip-rs, napsan\u00e9 v jazyce Rust a s p\u0159ibli\u017en\u011b 10 miliony sta\u017een\u00ed t\u00fddn\u011b, byla identifikov\u00e1na zranitelnost (CVE-2026-115905), kter\u00e1 umo\u017e\u0148uje vytv\u00e1\u0159et archivy, kter\u00e9 vypadaj\u00ed ne\u0161kodn\u011b, ale p\u0159i rozbalen\u00ed zraniteln\u00e9.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Rust-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 zip-rs \u0438 librsvg | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zip-rs, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043e\u043a\u043e\u043b\u043e 10 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-115905), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0430\u0440\u0445\u0438\u0432\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c\u0438, \u043d\u043e \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0438\u0437.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-27T09:40:44+00:00","article:modified_time":"2026-10-27T09:40:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=184011"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184011\/revisions"}],"predecessor-version":[{"id":184012,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184011\/revisions\/184012"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=184011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=184011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=184011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}