{"id":110388,"date":"2023-10-02T10:28:03","date_gmt":"2023-10-02T08:28:03","guid":{"rendered":"https:\/\/prohoster.info\/?p=110388"},"modified":"2023-10-02T10:28:03","modified_gmt":"2023-10-02T08:28:03","slug":"uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","title":{"rendered":"S\u00e5rbarheder i Linux-kernen, Glibc, GStreamer, Ghostscript, BIND og CUPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nogle nyligt identificerede s\u00e5rbarheder:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-39191 \u2014 en s\u00e5rbarhed i eBPF-subsystemet, der giver en lokal bruger mulighed for at h\u00e6ve sine privilegier og udf\u00f8re kode p\u00e5 kernniveau i Linux. S\u00e5rbarheden skyldes utilstr\u00e6kkelig validering af eBPF-programmer, som brugeren sender til udf\u00f8relse. For at angribe skal brugeren have mulighed for at indl\u00e6se sit eget BPF-program (hvis parameteren kernel.unprivileged_bpf_disabled er indstillet til 0, som det f.eks. er tilf\u00e6ldet i Ubuntu 20.04). Oplysninger om s\u00e5rbarheden blev sendt til kernudviklerne allerede i december sidste \u00e5r, og rettelsen blev uden offentlig omtale indf\u00f8rt i januar.\n<li class=\"l\"> CVE-2023-42753 \u2014 en fejl ved h\u00e5ndtering af array-indekser i ipset-implementeringen i netfilter-kernesubsystemet, som kan bruges til at inkrementere\/dekrementere pointere og skabe betingelser for skrive- eller l\u00e6seadgang til hukommelse uden for den tildelte buffer. Der er udarbejdet en prototype af et exploit, der for\u00e5rsager nedbrud (mere farlige udnyttelsesscenarier er ikke udelukket). Rettelsen er inkluderet i versionerne af kernen 5.4.257, 6.5.3, 6.4.16, 6.1.53, 5.10.195, 5.15.132.\n<li class=\"l\">  CVE-2023-39192, CVE-2023-39193, CVE-2023-39194 \u2014 flere s\u00e5rbarheder i Linux-kernen, der f\u00f8rer til l\u00e6kage af indhold fra kernens hukommelse p\u00e5 grund af muligheden for at l\u00e6se fra omr\u00e5der uden for den tildelte buffer i funktionerne match_flags og u32_match_it i Netfilter-subsystemet samt i koden til behandling af tilstandsfiltre. S\u00e5rbarhederne blev udbedret i august (1, 2) og juni.\n<li class=\"l\"> CVE-2023-42755 \u2014 en s\u00e5rbarhed, der lader en ikke-privilegeret lokal bruger for\u00e5rsage et kernenedbrud p\u00e5 grund af en fejl i arbejde med pointere i traffic classifieren rsvp. Problemet optr\u00e6der i LTS-kernerne 6.1, 5.15, 5.10, 5.4, 4.19 og 4.14. En prototype af et exploit er blevet udarbejdet. Rettelsen er endnu ikke blevet optaget i kernen og er tilg\u00e6ngelig som en patch.\n<li class=\"l\"> CVE-2023-42756 \u2014 en race condition i NetFilter-kernesubsystemet, der kan udnyttes af en lokal bruger til at for\u00e5rsage en Panic-tilstand. Der er tilg\u00e6ngelig en prototype af et exploit, der fungerer i det mindste i kernerne 6.5.rc7, 6.1 og 5.10. Rettelsen er endnu ikke blevet optaget i kernen og er tilg\u00e6ngelig som en patch.\n<li class=\"l\"> CVE-2023-4527 \u2014 stack overflow in the Glibc library occurring in the getaddrinfo function when processing DNS responses larger than 2048 bytes. This vulnerability may lead to data leakage from the stack or a crash. It manifests only in Glibc versions newer than 2.36 when using the \"no-aaaa\" option in \/etc\/resolv.conf.\n<li class=\"l\"> CVE-2023-40474, CVE-2023-40475 \u2014 vulnerabilities in the GStreamer multimedia framework caused by an integer overflow in the handlers for MXF video files. These vulnerabilities can allow the execution of the attacker's code when processing specially crafted MXF files in an application using GStreamer. The issue has been resolved in the gst-plugins-bad package 1.22.6.\n<li class=\"l\"> CVE-2023-40476 \u2014 buffer overflow in the GStreamer video handler for H.265, allowing code execution when processing specially crafted video. This vulnerability has been fixed in the gst-plugins-bad package 1.22.6.\n<li class=\"l\"> Analysis \u2014 an analysis of the exploit using CVE-2023-36664 vulnerability in the Ghostscript package to execute its code when opening specially crafted PostScript documents. This issue is caused by improper handling of filenames starting with the \"|\" symbol or the %pipe% prefix. The vulnerability has been fixed in Ghostscript release 10.01.2.\n<li class=\"l\"> CVE-2023-3341, CVE-2023-4236 \u2014 vulnerabilities in the BIND 9 DNS server that can cause the named process to crash when processing specially crafted control messages (access to the TCP port controlling named, which is only open for the loopback interface by default, is sufficient; knowledge of the RNDC key is not required) or create a certain high load in DNS-over-TLS mode. These vulnerabilities have been fixed in the BIND releases 9.16.44, 9.18.19, and 9.19.17.\n<li class=\"l\"> CVE-2023-4504 \u2014 a vulnerability in <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-newyork\/\"   title=\"serveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2674\">serveren<\/a> CUPS-print og libppd-biblioteket, der f\u00f8rer til buffer overflow ved behandling af specielt udformede dokumenter i PostScript-format. Det er ikke udelukket, at s\u00e5rbarheden kan udnyttes til at udf\u00f8re kode i systemet. Problemet er rettet i CUPS-versionerne 2.4.7 (patch) og libppd 2.0.0 (patch).            <\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59852\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2023-39191 &#8212; \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 Linux. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 eBPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0432\u043e\u0435\u0439 BPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b (\u0435\u0441\u043b\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 kernel.unprivileged_bpf_disabled \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0432 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 0, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043a\u0430\u043a \u0432 Ubuntu 20.04). [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110388","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2023-39191 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 Linux.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, Glibc, GStreamer, Ghostscript, BIND \u0438 CUPS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2023-39191 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 Linux.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-10-02T08:28:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-10-02T08:28:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheder i Linux-kernen, Glibc, GStreamer, Ghostscript, BIND og CUPS | ProHoster","description":"Flere nyligt identificerede s\u00e5rbarheder: CVE-2023-39191 - en s\u00e5rbarhed i eBPF-subsystemet, der giver en lokal bruger mulighed for at h\u00e6ve sine privilegier og udf\u00f8re kode p\u00e5 Linux-kernens niveau.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, Glibc, GStreamer, Ghostscript, BIND \u0438 CUPS | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2023-39191 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 Linux.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-02T08:28:03+00:00","article:modified_time":"2023-10-02T08:28:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110388","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:39:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=110388"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110388\/revisions"}],"predecessor-version":[{"id":159956,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110388\/revisions\/159956"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=110388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=110388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=110388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}