{"id":110740,"date":"2023-10-11T15:10:19","date_gmt":"2023-10-11T13:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda"},"modified":"2023-10-11T15:10:19","modified_gmt":"2023-10-11T13:10:19","slug":"uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","title":{"rendered":"Des vuln\u00e9rabilit\u00e9s dans les biblioth\u00e8ques X.Org, dont deux existent depuis 1988.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Des informations sur cinq vuln\u00e9rabilit\u00e9s dans les biblioth\u00e8ques libX11 et libXpm, d\u00e9velopp\u00e9es par le projet X.Org, ont \u00e9t\u00e9 publi\u00e9es. Les probl\u00e8mes sont r\u00e9solus dans les versions libXpm 3.5.17 et libX11 1.8.7. Trois vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans la biblioth\u00e8que libX11, qui offre des fonctions avec une impl\u00e9mentation client du protocole X11 :   <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-43785 \u2014 d\u00e9passement de tampon dans le code de libX11, qui se manifeste lors du traitement d'une r\u00e9ponse du serveur X avec un nombre de caract\u00e8res ne correspondant pas \u00e0 la requ\u00eate pr\u00e9c\u00e9demment envoy\u00e9e XkbGetMap. La vuln\u00e9rabilit\u00e9 est caus\u00e9e par une erreur dans X11R6.1, pr\u00e9sente depuis 1996. Elle peut \u00eatre exploit\u00e9e en connectant une application utilisant libx11 \u00e0 un serveur X malveillant ou \u00e0 un proxy interm\u00e9diaire contr\u00f4l\u00e9 par un attaquant.\n<li class=\"l\"> CVE-2023-43786 \u2014 \u00e9puisement de la pile en raison d'une r\u00e9cursion infinie dans la fonction PutSubImage() de libX11, se produisant lors du traitement de donn\u00e9es sp\u00e9cialement format\u00e9es au format XPM. La vuln\u00e9rabilit\u00e9 existe depuis la sortie de X11R2 en f\u00e9vrier 1988.\n<li class=\"l\"> CVE-2023-43787 \u2014 d\u00e9passement d'entier dans la fonction XCreateImage() de libX11, entra\u00eenant un d\u00e9passement de m\u00e9moire \u00e0 cause d'une erreur dans le calcul de la taille, ne correspondant pas \u00e0 la taille r\u00e9elle des donn\u00e9es. La fonction probl\u00e9matique XCreateImage() est appel\u00e9e \u00e0 partir de la fonction XpmReadFileToPixmap(), ce qui permet d'exploiter la vuln\u00e9rabilit\u00e9 lors du traitement d'un fichier sp\u00e9cialement format\u00e9 au format XPM. La vuln\u00e9rabilit\u00e9 existe \u00e9galement depuis X11R2 (1988).    <\/ul>\n<p>De plus, deux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 r\u00e9v\u00e9l\u00e9es dans la biblioth\u00e8que libXpm (CVE-2023-43788 et CVE-2023-43789), r\u00e9sultant de la possibilit\u00e9 de lire \u00e0 partir de zones en dehors des fronti\u00e8res de la m\u00e9moire allou\u00e9e. Les probl\u00e8mes se manifestent lors du chargement d'un commentaire \u00e0 partir d'un tampon en m\u00e9moire et du traitement d'un fichier XPM avec une carte de couleurs incorrecte. Les deux vuln\u00e9rabilit\u00e9s datent de 1998 et ont \u00e9t\u00e9 d\u00e9couvertes gr\u00e2ce \u00e0 l'application d'outils de d\u00e9tection des erreurs de gestion de la m\u00e9moire et de tests de fuzzing avec AddressSanitizer et libFuzzer.        <\/p>\n<p>X.org a des probl\u00e8mes de s\u00e9curit\u00e9 historiques, par exemple il y a dix ans, lors de la 30e conf\u00e9rence Chaos Communication Congress (CCC), lors d'une pr\u00e9sentation du chercheur en s\u00e9curit\u00e9 Ilja van Sprundel, la moiti\u00e9 de la pr\u00e9sentation \u00e9tait consacr\u00e9e aux probl\u00e8mes dans <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/server\/dts-newyork\/\"   title=\"le serveur\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2764\">le serveur<\/a> X.Org, et l'autre moiti\u00e9 de la s\u00e9curit\u00e9 des biblioth\u00e8ques clientes X11. Dans le rapport d'Ilya, qui a en 2013 r\u00e9v\u00e9l\u00e9 30 vuln\u00e9rabilit\u00e9s touchant diverses biblioth\u00e8ques clientes X11 ainsi que les composants DRI de Mesa, il y avait des d\u00e9clarations \u00e9motionnelles comme \u00ab GLX \u2014 c'est un horrible d\u00e9motivateur ! 80 000 lignes d'horreur pure ! \u00bb et \u00ab Au cours des derniers mois, j'ai trouv\u00e9 120 bugs, et je n'ai pas encore termin\u00e9 la v\u00e9rification \u00bb.<br \/>\n<br \/>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59906\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7. \u0422\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libx11, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 X11: CVE-2023-43785 &#8212; \u0432\u044b\u0445\u043e\u0434 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u043e\u0434\u0435 libX11, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u0442\u0432\u0435\u0442\u0430 \u043e\u0442 X-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441 \u0447\u0438\u0441\u043b\u043e\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432, \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110740","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 X.Org, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0441 1988 \u0433\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-10-11T13:10:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-10-11T13:10:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vuln\u00e9rabilit\u00e9s dans les biblioth\u00e8ques X.Org, dont deux existent depuis 1988 | ProHoster","description":"Des informations sur cinq vuln\u00e9rabilit\u00e9s dans les biblioth\u00e8ques libX11 et libXpm, d\u00e9velopp\u00e9es par le projet X.Org, ont \u00e9t\u00e9 rendues publiques. Les probl\u00e8mes ont \u00e9t\u00e9 corrig\u00e9s dans les versions libXpm 3.5.17 et libX11 1.8.7.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 X.Org, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0441 1988 \u0433\u043e\u0434\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-11T13:10:19+00:00","article:modified_time":"2023-10-11T13:10:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110740","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:40:03","updated":"2026-02-09 21:40:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/110740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=110740"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/110740\/revisions"}],"predecessor-version":[{"id":160044,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/110740\/revisions\/160044"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=110740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=110740"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=110740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}