Kunshin ImageMagick, wanda masu haɓaka gidan yanar gizon galibi ke amfani da shi don canza hotuna, yana da rauni CVE-2022-44268, wanda zai haifar da zubar da abubuwan cikin fayil idan an canza hotunan PNG da maharan suka shirya ta amfani da ImageMagick. Rashin lahani yana rinjayar tsarin da ke aiwatar da hotuna na waje sannan kuma ya ba da damar ɗaukar sakamakon juyawa.
Rashin lahani yana haifar da gaskiyar cewa lokacin da ImageMagick ke aiwatar da hoton PNG, yana amfani da abubuwan da ke cikin sigar "profile" daga toshe metadata don ƙayyade sunan fayil ɗin bayanin martaba, wanda aka haɗa a cikin fayil ɗin da aka samu. Don haka, don harin, ya isa ya ƙara ma'aunin "profile" tare da hanyar fayil ɗin da ake buƙata zuwa hoton PNG (misali, "/ sauransu/passwd") da kuma lokacin sarrafa irin wannan hoton, misali, lokacin canza girman hoton. , abubuwan da ke cikin fayil ɗin da ake buƙata za a haɗa su cikin fayil ɗin fitarwa . Idan ka saka "-" maimakon sunan fayil, mai sarrafa zai rataya yana jiran shigarwa daga daidaitaccen rafi, wanda za'a iya amfani dashi don haifar da ƙin sabis (CVE-2022-44267).
Har yanzu ba a fitar da sabuntawa don gyara rashin lafiyar ba, amma masu haɓaka ImageMagick sun ba da shawarar cewa a matsayin hanyar aiki don toshe ɗigon ruwa, ƙirƙirar doka a cikin saitunan da ke hana samun dama ga wasu hanyoyin fayil. Misali, don ƙin samun dama ta hanyar cikakkun hanyoyin dangi, zaku iya ƙara masu zuwa zuwa policy.xml:
Rubutun don ƙirƙirar hotunan PNG waɗanda ke amfani da raunin ya riga ya kasance a bainar jama'a.
source: budenet.ru