An fitar da bayanai game da lahani guda biyar a cikin ɗakunan karatu na libX11 da libXpm wanda aikin X.Org ya haɓaka. An warware matsalolin a cikin libXpm 3.5.17 da libX11 1.8.7. An gano lahani uku a cikin ɗakin karatu na libx11, wanda ke ba da ayyuka tare da aiwatar da abokin ciniki na ka'idar X11:
- CVE-2023-43785 - Maɓallin buffer a cikin lambar libX11 yana faruwa lokacin sarrafa amsa daga uwar garken X tare da adadin haruffa waɗanda basu dace da buƙatar XkbGetMap da aka aiko a baya ba. Rashin lahani yana haifar da bug a cikin X11R6.1 wanda ya wanzu tun 1996. Za a iya yin amfani da raunin rauni lokacin da aikace-aikacen da ke amfani da libx11 ya haɗu zuwa uwar garken X mai mugunta ko wakili na tsakiya mai sarrafa maharin.
- CVE-2023-43786 - Matsakaicin gajiya saboda maimaitawa mara iyaka a cikin aikin PutSubImage() a cikin libX11, wanda ke faruwa lokacin sarrafa bayanai na musamman a tsarin XPM. Rashin lahani ya wanzu tun lokacin da aka saki X11R2 a cikin Fabrairu 1988.
- CVE-2023-43787 Matsakaicin adadin lamba a cikin aikin XCreateImage() a cikin libX11 yana haifar da ambaliya saboda kuskuren ƙididdige girman da bai dace da ainihin girman bayanan ba. Ana kiran aikin XCreateImage() mai matsala daga aikin XpmReadFileToPixmap(), wanda ke ba da damar yin amfani da rauni yayin sarrafa fayil ɗin da aka ƙera na musamman a cikin tsarin XPM. Rashin lahani kuma ya wanzu tun X11R2 (1988).
Bugu da ƙari, an bayyana raunin biyu a cikin ɗakin karatu na libXpm (CVE-2023-43788 da CVE-2023-43789), wanda ya haifar da ikon karantawa daga wuraren da ke waje da iyakokin da aka keɓe. Matsaloli suna faruwa lokacin loda sharhi daga majigi a ƙwaƙwalwar ajiya da sarrafa fayil na XPM tare da taswirar launi mara daidai. Dukansu raunin sun kasance tun daga 1998 kuma an samo su ta hanyar amfani da gano kuskuren ƙwaƙwalwar ajiya da kayan aikin gwaji masu ban mamaki AddressSanitizer da libFuzzer.
X.org yana da matsalolin tsaro na tarihi, alal misali, shekaru goma da suka gabata, a taron Chaos Communication Congress (CCC) na 30th, gabatarwar da masanin tsaro Ilja van Sprundel ya ba da rabin gabatarwa ga matsaloli a cikin uwar garken X.Org, da sauran. rabin rabin tsaro na ɗakunan karatu na abokin ciniki na X11. Rahoton Ilya, wanda a cikin 2013 ya gano raunin 30 da ke shafar ɗakunan karatu na abokin ciniki na X11 daban-daban, da kuma abubuwan Mesa's DRI, sun haɗa da irin waɗannan maganganun motsin rai kamar “GLX mummuna ne! Layi 80 na tsantsar tsoro! da "Na sami kwari 000 a ciki a cikin watanni biyun da suka gabata, kuma ban gama duba shi ba tukuna."
source: budenet.ru