{"id":111788,"date":"2023-11-27T15:10:15","date_gmt":"2023-11-27T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos"},"modified":"2023-11-27T15:10:15","modified_gmt":"2023-11-27T13:10:15","slug":"uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","title":{"rendered":"Haavatavused Perl, ownCloud, GStreamer ja Zephyr RTOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Mitmed hiljuti avastatud haavatavused:  <\/p>\n<ul>\n<li class=\"l\"> Perl 5.38.1 korrigeeriv v\u00e4ljalase k\u00f5rvaldab turvaaugu (CVE-2023-47038), mis v\u00f5ib p\u00f5hjustada \u00fche bait kirjutamist reserveeritud puhvriv\u00e4listesse kohtadesse, kui k\u00e4sitletakse kompileeritud regulaaravaldisi, millel on vigaselt uuesti m\u00e4\u00e4ratud sisemine Unicode-omadus, mille nimi algab &#171;utf8::perl&#187;. Probleem ilmneb alates Perl 5.30 harust.\n<p>Lisaks on Perl 5.38.1 k\u00f5rvaldatud Windowsi platvormile spetsiifiline turvavahe (CVE-2023-47039), mis v\u00f5imaldab k\u00e4ivitada oma koodi skriptide k\u00e4ivitamisel, kui praeguses kataloogis on v\u00f5imalus cmd.exe faili paigutamiseks (t\u00e4nu sellele, et Perl ei puhasta teid rakendustefailide otsimiseks, proovib see k\u00f5igepealt k\u00e4ivitada cmd.exe praeguses kataloogis). N\u00e4iteks v\u00f5ib r\u00fcndaja paigutada oma cmd.exe kataloogi C:&#092;ProgramData ja suurendada oma \u00f5igusi, kui administraator k\u00e4ivitab Perl-skripti sellest kataloogist.    <\/p>\n<li class=\"l\"> Pilveplatvormil ownCloud, mis eraldus projektist Nextcloud 2016. aastal, on leitud haavatavus (CVE-2023-49103), mis m\u00f5jutab graphapi rakendust ja v\u00f5imaldab tuvastada keskkonnamuutujate sisu, mis v\u00f5ivad sisaldada administraatori parooli, litsentsiv\u00f5tit ja e-posti kaug\u00fchenduse mandaati. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-shicago\/\"   title=\"serveri\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2915\">serveri<\/a>Probleem on p\u00f5hjustatud graphapi-s kolmanda osapoole teegi kasutamisest, mis muu hulgas pakub GetPhpInfo.php t\u00f6\u00f6tlejat, mis kutsub v\u00e4lja phpinfo() funktsiooni, mille v\u00e4ljundis on keskkonnamuutujad.\n<li class=\"l\"> Multimeedia raamistiku GStreamer'is on avastatud kaks turvaauku: CVE-2023-44446 \u2014 m\u00e4lu kasutamine p\u00e4rast vabastamist (Use-After-Free) MXF-failide anal\u00fc\u00fcsi koodis; CVE-2023-44429 \u2014 puhvril\u00e4bivool AV1 formaadi anal\u00fc\u00fcsi koodis. Esimene probleem tuleneb objekti kontrollimise puudumisest enne operatsioonide teostamist, teine aga andmete suuruse kontrollimise puudumisest enne fikseeritud puhvri kopeerimist. Turvaaugu t\u00f5ttu v\u00f5ib r\u00fcndaja kood k\u00e4ivituda spetsiaalselt vormindatud MXF-failide ja AV1 formaadis multimeedia andmete t\u00f6\u00f6tlemise katsetel. R\u00fcnnakusuunad s\u00f5ltuvad r\u00fcnnatavast rakendusest. Probleemidele on antud ohtlikkuse tasemeks 8.8 skaalal 10. Turvaaugud on k\u00f5rvaldatud GStreamer 1.22.7 v\u00e4ljalaskes.\n<li class=\"l\"> Reaalajas t\u00f6\u00f6tavates s\u00fcsteemides Zephyr RTOS on tuvastatud 25 haavatavust, millest enamik v\u00f5ivad potentsiaalselt viia r\u00fcndaja koodi t\u00e4itmiseks. Haavatavused on p\u00f5hjustatud puhvers\u00fcsteemide \u00fclet\u00e4itmistest WiFi shell'is, Bluetooth'i virnas, IPM draiveris, USB virnas, IEEE 802.15.4 draiveris, Mgmt alams\u00fcsteemis, failis\u00fcsteemis, eS-WiFi draiveris ja CANbus alams\u00fcsteemis. Enamik haavatavusi on k\u00f5rvaldatud Zephyr 3.5.0 versioonis, kuid \u00fcks probleem (CVE-2023-4261) j\u00e4\u00e4b parandamata (selle haavatavuse kohta \u00fcksikasju ei avaldata enne paranduse ilmumist).    <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60185\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Unicode-\u0441\u0432\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c, \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u043c\u0441\u044f \u043d\u0430 &#171;utf8::perl&#187;. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 Perl 5.30. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u0430\u044f \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111788","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused Perl'is, ownCloud'is, GStreamer'is ja Zephyr RTOS'is | ProHoster","description":"M\u00f5ned hiljuti avastatud haavatavused: Perl 5.38.1 parandavas v\u00e4ljaandes k\u00f5rvaldatud haavatavus (CVE-2023-47038), mis v\u00f5ib viia \u00fche baitide kirjed eraldatud puhvers\u00fcsteemi piires.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-27T13:10:15+00:00","article:modified_time":"2023-11-27T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111788","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:03","updated":"2026-02-09 21:42:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=111788"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111788\/revisions"}],"predecessor-version":[{"id":160195,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111788\/revisions\/160195"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=111788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=111788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=111788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}