{"id":111788,"date":"2023-11-27T15:10:15","date_gmt":"2023-11-27T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos"},"modified":"2023-11-27T15:10:15","modified_gmt":"2023-11-27T13:10:15","slug":"uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","title":{"rendered":"S\u00e5rbarheder i Perl, ownCloud, GStreamer og Zephyr RTOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nogle nyligt opdagede s\u00e5rbarheder:  <\/p>\n<ul>\n<li class=\"l\"> I den korrigerede version af Perl 5.38.1 er en s\u00e5rbarhed (CVE-2023-47038) blevet rettet, som kan f\u00f8re til, at der skrives \u00e9t byte uden for den tildelte buffer ved behandling af komprimerede regul\u00e6re udtryk med et forkert gendefineret internt Unicode-egenskab, der starter med &#171;utf8::perl&#187;. Problemet optr\u00e6der fra Perl 5.30-grenen.\n<p>Derudover er der i Perl 5.38.1 rettet en Windows-specifik s\u00e5rbarhed (CVE-2023-47039), der g\u00f8r det muligt at udf\u00f8re sin kode, n\u00e5r der k\u00f8res scripts med mulighed for at placere filen cmd.exe i den nuv\u00e6rende mappe (p\u00e5 grund af manglende oprydning af veje til at finde eksekverbare filer; Perl fors\u00f8ger f\u00f8rst at k\u00f8re cmd.exe i den nuv\u00e6rende mappe). For eksempel kan en angriber placere sin cmd.exe i C:\u200b\\ProgramData og h\u00f8jne sine privilegier, hvis en administrator k\u00f8rer et Perl-script fra denne mappe.    <\/p>\n<li class=\"l\"> I cloud-platformen ownCloud, som blevet adskilt fra projektet Nextcloud i 2016, er der opdaget en s\u00e5rbarhed (CVE-2023-49103), der p\u00e5virker applikationen graphapi og g\u00f8r det muligt at afsl\u00f8re indholdet af milj\u00f8variabler, der kan indeholde administratorens kodeord, licensn\u00f8gler og legitimationsoplysninger til forbindelse med e-mail. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-shicago\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2915\">server<\/a>Problemet skyldes brugen af et tredjepartsbibliotek i graphapi, som blandt andet leverer en h\u00e5ndtering af GetPhpInfo.php, der kalder funktionen phpinfo(), hvis output indeholder milj\u00f8variabler.\n<li class=\"l\"> I det multimediale framework GStreamer er der opdaget to s\u00e5rbarheder: CVE-2023-44446 \u2014 adgang til hukommelse efter frigivelse (Use-After-Free) i koden til parsing af MXF-filer; CVE-2023-44429 \u2014 bufferoverl\u00f8b i koden til parsing af AV1-formatet. Det f\u00f8rste problem skyldes manglende kontrol af objektet, f\u00f8r der udf\u00f8res operationer med det, og det andet manglende kontrol af datast\u00f8rrelse, f\u00f8r der kopieres til en fast buffer. S\u00e5rbarhederne kan f\u00f8re til eksekvering af en angribers kode ved fors\u00f8g p\u00e5 at behandle specielt tilrettelagte MXF-filer og multimediedata i AV1-format. Angrebsvinklerne afh\u00e6nger af den angrebne applikations implementering. S\u00e5rbarhederne er blevet tildelt en faregrad p\u00e5 8,8 ud af 10. S\u00e5rbarhederne er blevet rettet i GStreamer 1.22.7.\n<li class=\"l\"> I det realtidsoperativsystem Zephyr RTOS er der opdaget 25 s\u00e5rbarheder, hvoraf de fleste potentielt kan f\u00f8re til udf\u00f8relse af ondsindet kode. S\u00e5rbarhederne for\u00e5rsages af buffer overflow i WiFi shell, Bluetooth-stakken, IPM-driveren, USB-stakken, IEEE 802.15.4-driveren, Mgmt-subsystemet, filsystemet, eS-WiFi-driveren og CANbus-subsystemet. De fleste s\u00e5rbarheder blev rettet i Zephyr 3.5.0-versionen, men \u00e9t problem (CVE-2023-4261) forbliver uoprettet (detaljer om denne s\u00e5rbarhed offentligg\u00f8res ikke f\u00f8r en rettelse er tilg\u00e6ngelig).    <\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60185\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Unicode-\u0441\u0432\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c, \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u043c\u0441\u044f \u043d\u0430 &#171;utf8::perl&#187;. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 Perl 5.30. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u0430\u044f \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111788","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheder i Perl, ownCloud, GStreamer og Zephyr RTOS | ProHoster","description":"Nogle nyligt opdagede s\u00e5rbarheder: I den korrigerende udgave af Perl 5.38.1 er en s\u00e5rbarhed (CVE-2023-47038) blevet udbedret, som kan f\u00f8re til skrivning af et byte uden for det tildelte buffer.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-27T13:10:15+00:00","article:modified_time":"2023-11-27T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111788","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:03","updated":"2026-02-09 21:42:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=111788"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111788\/revisions"}],"predecessor-version":[{"id":160195,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111788\/revisions\/160195"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=111788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=111788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=111788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}