{"id":113253,"date":"2024-01-30T13:41:05","date_gmt":"2024-01-30T11:41:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg"},"modified":"2024-01-30T13:41:05","modified_gmt":"2024-01-30T11:41:05","slug":"uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg","title":{"rendered":"Ranljivosti u implementaciji JPEG XL iz paketa FFmpeg","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Otkrivene su informacije o dvjema ranjivostima u dekoderu formata JPEG XL, koji je isporu\u010den u paketu FFmpeg, a koje mogu dovesti do izvr\u0161avanja zlonamjernog koda prilikom obrade posebno oblikovanih slika u FFmpeg-u. Problemi su rije\u0161eni u izdanju FFmpeg 6.1, ali budu\u0107i da je podr\u0161ka za JPEG XL uklju\u010dena od grane 6.1, ranjivost se odnosi samo na sustave koji koriste eksperimentalne verzije FFmpeg 6.1 ili prenose izmjene iz njih. <\/p>\n

Prva ranjivost (CVE-2024-22860) uzrokovana je prekora\u010denjem cjelobrojnog tipa u parseru formata JPEG XL, koje je nastalo zbog nedostatka provjere veli\u010dine int tipa. Druga ranjivost (CVE-2024-22862) nastala je zbog prekora\u010denja cjelobrojnog tipa u funkciji jpegxl_anim_read_packet, koja se koristi za dekodiranje animacija, a povezana je s kori\u0161tenjem potpisanog tipa int64_t umjesto bez znakova uint64_t. Problemi su specifi\u010dni za FFmpeg i ne manifestiraju se u referentnoj implementaciji libjxl.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 FFmpeg \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 JPEG XL, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 FFmpeg \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 FFmpeg 6.1, \u043d\u043e \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 JPEG XL \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 6.1, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 FFmpeg 6.1 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113253","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivosti u implementaciji JPEG XL u okviru FFmpeg-a | ProHoster","description":"Otkrivene su informacije o dvjema ranjivostima u dekoderu formata JPEG XL, koji je isporu\u010den u paketu FFmpeg, a koje mogu dovesti do izvr\u0161avanja zlonamjernog koda prilikom obrade posebno oblikovanih slika u FFmpeg-u.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 JPEG XL \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 FFmpeg | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 FFmpeg \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 JPEG XL, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 FFmpeg \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-30T11:41:05+00:00","article:modified_time":"2024-01-30T11:41:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=113253"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113253\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=113253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=113253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=113253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}