{"id":37676,"date":"2019-10-31T22:18:59","date_gmt":"2019-10-31T19:18:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ocherednye-4-uyazvimosti-v-ghostscript\/"},"modified":"2019-10-31T22:18:59","modified_gmt":"2019-10-31T19:18:59","slug":"ocherednye-4-uyazvimosti-v-ghostscript","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/ocherednye-4-uyazvimosti-v-ghostscript","title":{"rendered":"Quatre nouvelles vuln\u00e9rabilit\u00e9s dans Ghostscript","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Deux semaines apr\u00e8s la d\u00e9couverte<\/a><\/noindex> du probl\u00e8me critique pr\u00e9c\u00e9dent dans Ghostscript<\/a><\/noindex> ont \u00e9t\u00e9 identifi\u00e9es<\/a><\/noindex> quatre autres vuln\u00e9rabilit\u00e9s similaires (CVE-2019-14811, CVE-2019-14812, CVE-2019-14813, CVE-2019-14817) qui permettent de contourner le mode d'isolement \u00ab -dSAFER \u00bb en cr\u00e9ant un lien vers \u00ab .forceput \u00bb. En traitant des documents sp\u00e9cialement format\u00e9s, un attaquant peut acc\u00e9der au contenu du syst\u00e8me de fichiers et ex\u00e9cuter du code arbitraire sur le syst\u00e8me (par exemple, en ajoutant des commandes dans ~\/.bashrc ou ~\/.profile). Le correctif est disponible sous forme de patchs.1<\/a><\/noindex>, 2<\/a><\/noindex>). Suivez les mises \u00e0 jour des paquets dans les distributions sur ces pages : Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, RHEL<\/a><\/noindex>, Arch<\/a><\/noindex>, ROSA<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. <\/p>\n

Rappelons que les vuln\u00e9rabilit\u00e9s dans Ghostscript repr\u00e9sentent un danger accru, car ce paquet est utilis\u00e9 dans de nombreuses applications populaires pour le traitement des formats PostScript et PDF. Par exemple, Ghostscript est appel\u00e9 lors de la cr\u00e9ation de miniatures sur le bureau, lors de l'indexation des donn\u00e9es en arri\u00e8re-plan et lors de la conversion d'images. Pour qu'une attaque r\u00e9ussisse, dans de nombreux cas, il suffit de t\u00e9l\u00e9charger un fichier contenant un exploit ou de visualiser le r\u00e9pertoire contenant celui-ci dans Nautilus. Les vuln\u00e9rabilit\u00e9s dans Ghostscript peuvent \u00e9galement \u00eatre exploit\u00e9es via des gestionnaires d'images bas\u00e9s sur les paquets ImageMagick et GraphicsMagick, en leur transmettant un fichier JPEG ou PNG, dans lequel le code PostScript remplace l'image (ce fichier sera trait\u00e9 dans Ghostscript, car le type MIME est reconnu par le contenu, et non en se fiant \u00e0 l'extension).<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043f\u0443\u0441\u0442\u044f \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 Ghostscript \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0435\u0449\u0451 4 \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-14811, CVE-2019-14812, CVE-2019-14813, CVE-2019-14817), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 «.forceput» \u043e\u0431\u043e\u0439\u0442\u0438 \u0440\u0435\u0436\u0438\u043c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 «-dSAFER». \u041f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u0424\u0421 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37676","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Quatre nouvelles vuln\u00e9rabilit\u00e9s dans Ghostscript | ProHoster","description":"Deux semaines apr\u00e8s la d\u00e9couverte du probl\u00e8me critique pr\u00e9c\u00e9dent dans","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/ocherednye-4-uyazvimosti-v-ghostscript","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0447\u0435\u0440\u0435\u0434\u043d\u044b\u0435 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Ghostscript | ProHoster","og:description":"\u0421\u043f\u0443\u0441\u0442\u044f \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/ocherednye-4-uyazvimosti-v-ghostscript","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:18:59+00:00","article:modified_time":"2019-10-31T19:18:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37676","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 18:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:22:29","updated":"2026-01-23 18:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/37676","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=37676"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/37676\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=37676"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=37676"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=37676"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}