{"id":123495,"date":"2025-04-14T09:05:08","date_gmt":"2025-04-14T07:05:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov"},"modified":"2025-04-14T09:05:08","modified_gmt":"2025-04-14T07:05:08","slug":"perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","title":{"rendered":"Perlis esinev puhver\u00fclevus, mis on seotud s\u00fcmbolite t\u00f6\u00f6tlemisega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldati Perl 5.40.2 ja 5.38.4 t\u00f5lgendi parandavad uuendused, milles k\u00f5rvaldatakse haavatavust (CVE-2024-56406), mis p\u00f5hjustab puhvrisse \u00fclevoolu, kui translitereeritakse spetsiaalselt vormindatud mitte-ASCII m\u00e4rke operaatori «tr\/..\/..» abil. Ei ole v\u00e4listatud haavatavuse \u00e4ra kasutamise v\u00f5imalus, et teostada oma koodi t\u00e4itmist s\u00fcsteemis. Probleem avaldub stabiilsetes Perl'i v\u00e4ljaannetes alates 2021. aastast ja m\u00f5jutab Perl 5.34, 5.36, 5.38 ja 5.40 haru. Haavatavuse k\u00f5rvaldamise j\u00e4lgimiseks distributiivides saab k\u00fclastada j\u00e4rgmisi lehti: Debian, Ubuntu, Fedora, Arch, FreeBSD. RHEL 9, SUSE 15 ja openSUSE Leap 15.6 p\u00f5hinevad distributiivid ei ole haavatavad, kuna sisaldavad Perl versioone 5.32 ja 5.26. <\/p>\n

Haavatavus m\u00f5jutab programme, mis kasutavad kontrollimata v\u00e4liseid andmeid operaatori «tr» vasakus osas, kus n\u00e4idatakse m\u00e4ndi andmeid m\u00e4rkide asendamiseks (n\u00e4iteks «$external_string =~ tr\/a\/b\/»). Operaatori funktsioonis S_do_trans_invmap() toimub teatud mitte-ASCII baitide t\u00f6\u00f6tlemisel m\u00e4lu juurde p\u00e4\u00e4semine v\u00e4ljaspool eraldatud puhvrimahtu. \u00dclevool toimub kuna m\u00f5ned andmekogumi baitide j\u00e4rjestused v\u00f5ivad teisendada UTF-8 j\u00e4rjestusteks, mille jaoks on vajalik kaks baiti \u00fche asemel. <\/p>\n

T\u00e4htis on, et haavatavus tekkis p\u00e4rast 2020. aastal lisatud muudatust, mis eemaldas t\u00e4iendava kontrolli piisava m\u00e4lu eraldamise \u00fcle, l\u00e4htudes v\u00e4itest, et suuruse arvutamisel piisab suuruse \u00fcmardamisest \u00fclespoole. Haavatavuse kontrollimiseks v\u00f5ib k\u00e4ivitada j\u00e4rgmise koodi: perl -e ‘$_ = «\x{FF}» x 1000000; tr\/\xFF\/\x{100}\/;’ Segmenteerimisviga (core dumped)
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 Perl 5.40.2 \u0438 5.38.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-56406), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0442\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435-ASCII \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 «tr\/..\/..\/». \u041d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u043b\u0438\u0437\u0430\u0445 Perl \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2021 \u0433\u043e\u0434\u0430 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0442\u043a\u0438 Perl 5.34, 5.36, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123495","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Puhverdamise \u00fclevool Perl'is, mis on seotud m\u00e4rkide t\u00f6\u00f6tlemisega | ProHoster","description":"Avaldati Perl 5.40.2 ja 5.38.4 t\u00f5rkeparandused, milles on k\u00f5rvaldatud haavatavus (CVE-2024-56406), mis p\u00f5hjustab puhverdamise \u00fclevoolu spetsiaalselt vormindatud mitte-ASCII m\u00e4rkide transkribeerimise ajal.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 Perl, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0435 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 Perl 5.40.2 \u0438 5.38.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-56406), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0442\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435-ASCII.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-14T07:05:08+00:00","article:modified_time":"2025-04-14T07:05:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123495","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:12:19","updated":"2026-01-23 12:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=123495"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123495\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=123495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=123495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=123495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}