{"id":137924,"date":"2025-06-21T23:12:01","date_gmt":"2025-06-21T21:12:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda"},"modified":"2025-06-21T23:12:01","modified_gmt":"2025-06-21T21:12:01","slug":"uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","title":{"rendered":"Libxml2 teegis esinevad haavatavused, mis v\u00f5ivad p\u00f5hjustada koodi t\u00e4itmist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GNOME projekti arendatav Libxml2 teek, mida kasutatakse XML-formaadis sisu anal\u00fc\u00fcsimiseks, on tuvastanud 5 haavatavust, millest kaks v\u00f5ivad potentsiaalselt p\u00f5hjustada koodi t\u00e4itmist spetsiaalselt vormindatud v\u00e4listest andmetest t\u00f6\u00f6tlemise k\u00e4igus. Libxml2 teek on laialdaselt kasutusel avatud projektides ja seda kasutatakse n\u00e4iteks s\u00f5ltuvusena \u00fcle 800 pakendis, mis on osa Ubuntu'ist. <\/p>\n

Esimene haavatavus (CVE-2025-6170) on p\u00f5hjustatud puhver\u00fclevoolust xmllint interaktiivse k\u00e4surealiidese rakenduses, mille eesm\u00e4rk on XML-failide anal\u00fc\u00fcsimine. \u00dclevool tekib v\u00e4ga pikkade k\u00e4suridade t\u00f6\u00f6tlemisel, kuna puhvri suuruse kontrollimiseks enne andmete kopeerimist strcpy() funktsiooni abil ei tehta korrektset kontrolli. Haavatavuse kasutamiseks peab r\u00fcndaja olema suuteline m\u00f5jutama xmllint utiliidile edastatud k\u00e4ske. Praegu pole haavatavuse parandamiseks plaastrit saadaval. <\/p>\n

Teine haavatavus (CVE-2025-6021) esineb xmlBuildQName() funktsiooni rakenduses ja p\u00f5hjustab andmete kirjutamist puhvri piiridest v\u00e4ljapoole, kuna puhver on intressikontode \u00fclevoolu t\u00f5ttu valesti arvutatud, tuginedes prefiksile ja kohalikele nimedele. Haavatavuse kasutamiseks peab r\u00fcndaja olema suuteline asendama oma andmed funktsioonile xmlBuildQName() edastatud prefiksi ja ncname'i argumentides. Haavatavuse parandamiseks on olemas plaastr, mis on lisatud libxml2 versiooni 2.14.4 v\u00e4ljaandesse. Uue paketiversiooni v\u00f5i paranduse seisundi kontrollimiseks jaotustes saab leida j\u00e4rgmistelt lehtedelt (kui leht on k\u00e4ttesaamatu, t\u00e4hendab see, et jaotuse arendajad pole veel probleemiga tegelemiseks alustanud): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo ja Arch (1, 2). <\/p>\n

\u00dclej\u00e4\u00e4nud kolm probleemi p\u00f5hjustavad kokkuvarisemisi, kuna juurdep\u00e4\u00e4s toimub juba vabastatud m\u00e4lu piirkonda funktsioonis xmlSchematronGetNode (CVE-2025-49794), null-viitide t\u00fchjendamine funktsioonis xmlXPathCompiledEval (CVE-2025-49795) ja vale t\u00fc\u00fcpide k\u00e4sitsemine (Type Confusion) funktsioonis xmlSchematronFormatReport (CVE-2025-49796). Nende haavatavuste k\u00f5rvaldamiseks kaalutakse v\u00f5imalust eemaldada libxml2 toetus Schematron m\u00e4rgistuskeelele. <\/p>\n

T\u00f5detakse, et libxslt teegis on kolm unparandatud haavatavust, mida ei toetata. T\u00e4iendav teave nende probleemide kohta avaldatakse 9. juulil, 13. juulil ja 6. augustil. Samuti on m\u00e4rgitud, et GNOME'i seotud projektides gvfs, libgxps, gdm, glib, GIMP ja libsoup on unparandatud ja avalikult mitte avaldatud haavatavused. <\/p>\n

T\u00e4iendav m\u00e4rkus: libxml2 toetaja on v\u00e4ljendanud, et edaspidi k\u00e4sitleb ta haavatavusi tavaliste vigadena, andes neile madalama prioriteedi, parandades need vaba aja korral ja paljastades kohe haavatavuse olemuse ilma embargo v\u00f5i kolmandate osapoolte toodetes k\u00f5rvalehoidmise ajata.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Libxml2 \u0448\u0438\u0440\u043e\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 \u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Ubuntu. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-6170) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-137924","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47libxml2 teegi haavatavused, mis v\u00f5ivad potentsiaalselt p\u00f5hjustada koodi t\u00e4itmist | ProHoster","description":"GNOME'i projekti arendatav libxml2 teegis, mis on m\u00f5eldud XML-formaadis sisu anal\u00fc\u00fcsimiseks, tuvastati 5 haavatavust, millest kaks v\u00f5ivad potentsiaalselt p\u00f5hjustada koodi t\u00e4itmist, kui neid t\u00f6\u00f6deldakse spetsiaalselt.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libxml2, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-21T21:12:01+00:00","article:modified_time":"2025-06-21T21:12:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"137924","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:23:11","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:23:11","updated":"2026-01-23 13:23:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/137924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=137924"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/137924\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=137924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=137924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=137924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}