{"id":110740,"date":"2023-10-11T15:10:19","date_gmt":"2023-10-11T13:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda"},"modified":"2023-10-11T15:10:19","modified_gmt":"2023-10-11T13:10:19","slug":"uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","title":{"rendered":"Sebezhet\u0151s\u00e9gek az X.Org k\u00f6nyvt\u00e1rakban, amelyek k\u00f6z\u00fcl kett\u0151 m\u00e1r 1988 \u00f3ta jelen van.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nyilv\u00e1noss\u00e1gra hozt\u00e1k az X.Org projekt \u00e1ltal fejlesztett libX11 \u00e9s libXpm k\u00f6nyvt\u00e1rak \u00f6t sebezhet\u0151s\u00e9g\u00e9r\u0151l sz\u00f3l\u00f3 inform\u00e1ci\u00f3t. A probl\u00e9m\u00e1kat a libXpm 3.5.17 \u00e9s libX11 1.8.7 verzi\u00f3kban orvosolt\u00e1k. H\u00e1rom sebezhet\u0151s\u00e9g a libX11 k\u00f6nyvt\u00e1rban tal\u00e1lhat\u00f3, amely az X11 protokoll kliensoldali megval\u00f3s\u00edt\u00e1s\u00e1nak funkci\u00f3it k\u00edn\u00e1lja:   <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-43785 \u2014 t\u00falcsordul\u00e1s a libX11 k\u00f3dj\u00e1ban, amely az X-kiszolg\u00e1l\u00f3 v\u00e1lasz\u00e1nak feldolgoz\u00e1sa sor\u00e1n jelentkezik, ahol a karakterek sz\u00e1ma nem felel meg az el\u0151z\u0151leg elk\u00fcld\u00f6tt XkbGetMap k\u00e9r\u00e9snek. A sebezhet\u0151s\u00e9get az X11R6.1 k\u00f3dj\u00e1ban tal\u00e1lhat\u00f3 hiba okozza, amely 1996 \u00f3ta l\u00e9tezik. A sebezhet\u0151s\u00e9g kihaszn\u00e1lhat\u00f3, ha egy libx11-t haszn\u00e1l\u00f3 alkalmaz\u00e1s csatlakozik egy rosszindulat\u00fa X-kiszolg\u00e1l\u00f3hoz vagy egy t\u00e1mad\u00f3 \u00e1ltal ir\u00e1ny\u00edtott k\u00f6ztes proxyhoz.\n<li class=\"l\"> CVE-2023-43786 \u2014 a stack kimer\u00fcl\u00e9se v\u00e9gtelen rekurzi\u00f3 miatt a PutSubImage() f\u00fcggv\u00e9nyben a libX11-ben, amely akkor l\u00e9p fel, amikor kifejezetten megform\u00e1zott XPM adatok feldolgoz\u00e1sa t\u00f6rt\u00e9nik. A sebezhet\u0151s\u00e9g az\u00f3ta l\u00e9tezik, hogy az X11R2 megjelent 1988 febru\u00e1rj\u00e1ban.\n<li class=\"l\"> CVE-2023-43787 \u2014 eg\u00e9sz sz\u00e1m\u00fa overflow az XCreateImage() f\u00fcggv\u00e9nyben a libX11-ben, amely a m\u00e9ret hib\u00e1s kisz\u00e1m\u00edt\u00e1sa miatt verem t\u00falcsordul\u00e1st okoz, \u00e9s nem felel meg a val\u00f3s adatok m\u00e9ret\u00e9nek. Az \u00e9rintett XCreateImage() f\u00fcggv\u00e9ny az XpmReadFileToPixmap() f\u00fcggv\u00e9nyb\u0151l h\u00edv\u00f3dik meg, ami lehet\u0151v\u00e9 teszi a sebezhet\u0151s\u00e9g kihaszn\u00e1l\u00e1s\u00e1t kifejezetten megform\u00e1zott XPM f\u00e1jl feldolgoz\u00e1sa sor\u00e1n. A sebezhet\u0151s\u00e9g szint\u00e9n az X11R2 \u00f3ta l\u00e9tezik (1988).    <\/ul>\n<p>Ezen k\u00edv\u00fcl k\u00e9t sebezhet\u0151s\u00e9get is felfedeztek a libXpm k\u00f6nyvt\u00e1rban (CVE-2023-43788 \u00e9s CVE-2023-43789), amelyeket a lefoglalt mem\u00f3riahat\u00e1rokon k\u00edv\u00fcli olvas\u00e1si lehet\u0151s\u00e9g okoz. A probl\u00e9m\u00e1k akkor jelentkeznek, amikor egy komment\u00e1rt t\u00f6ltenek be a mem\u00f3ria puffereib\u0151l, \u00e9s amikor egy hib\u00e1s sz\u00ednk\u00e9szletet tartalmaz\u00f3 XPM f\u00e1jlt dolgoznak fel. Mindk\u00e9t sebezhet\u0151s\u00e9g 1998-ra dat\u00e1lhat\u00f3, \u00e9s a mem\u00f3riahaszn\u00e1lati hib\u00e1k felfedez\u00e9s\u00e9re kifejlesztett eszk\u00f6z\u00f6k \u00e9s a fuzzing-tesztel\u00e9s, mint az AddressSanitizer \u00e9s a libFuzzer alkalmaz\u00e1s\u00e1nak k\u00f6sz\u00f6nhet\u0151en ker\u00fcltek napvil\u00e1gra.        <\/p>\n<p>X.org t\u00f6rt\u00e9nelmileg biztons\u00e1gi probl\u00e9m\u00e1kkal k\u00fczd\u00f6tt, p\u00e9ld\u00e1ul t\u00edz \u00e9vvel ezel\u0151tt a Chaos Communication Congress (CCC) 30. konferenci\u00e1j\u00e1n Ilja van Sprundel biztons\u00e1gi kutat\u00f3 el\u0151ad\u00e1s\u00e1nak fele az ezen sebezhet\u0151s\u00e9gek probl\u00e9m\u00e1ival foglalkozott. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hu\/server\/dts-newyork\/\"   title=\"szerveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2764\">szerveren<\/a> X.Org, valamint a X11 kliens k\u00f6nyvt\u00e1rok biztons\u00e1g\u00e1nak m\u00e1sodik fele. Ilya 2013-as jelent\u00e9se 30 sebezhet\u0151s\u00e9get t\u00e1rt fel, amelyek sz\u00e1mos k\u00fcl\u00f6nb\u00f6z\u0151 X11 kliens k\u00f6nyvt\u00e1rat \u00e9s a Mesa DRI komponenseket \u00e9rintettek, \u00e9s tartalmazott olyan \u00e9rzelmes megjegyz\u00e9seket, mint \u201eGLX \u2014 ez egy sz\u00f6rny\u0171 demotiv\u00e1tor! 80 000 sor folyamatos borzalom!\u201d \u00e9s \u201eAz utols\u00f3 h\u00f3napokban 120 hib\u00e1t tal\u00e1ltam benne, \u00e9s m\u00e9g nem fejeztem be az ellen\u0151rz\u00e9st.\u201d<br \/>\n<br \/>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59906\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7. \u0422\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libx11, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 X11: CVE-2023-43785 &#8212; \u0432\u044b\u0445\u043e\u0434 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u043e\u0434\u0435 libX11, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u0442\u0432\u0435\u0442\u0430 \u043e\u0442 X-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441 \u0447\u0438\u0441\u043b\u043e\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432, \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110740","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 X.Org, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0441 1988 \u0433\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-10-11T13:10:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-10-11T13:10:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9gek az X.Org k\u00f6nyvt\u00e1rakban, amelyek k\u00f6z\u00fcl kett\u0151 1988 \u00f3ta jelen van | ProHoster","description":"Nyilv\u00e1noss\u00e1gra hozt\u00e1k a libX11 \u00e9s libXpm k\u00f6nyvt\u00e1rakban l\u00e9v\u0151 \u00f6t sebezhet\u0151s\u00e9get, amelyeket az X.Org projekt fejlesztett. A probl\u00e9m\u00e1k jav\u00edtva lettek a libXpm 3.5.17 \u00e9s a libX11 1.8.7 kiad\u00e1sokban.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 X.Org, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0441 1988 \u0433\u043e\u0434\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-11T13:10:19+00:00","article:modified_time":"2023-10-11T13:10:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110740","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:40:03","updated":"2026-02-09 21:40:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/110740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=110740"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/110740\/revisions"}],"predecessor-version":[{"id":160044,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/110740\/revisions\/160044"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=110740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=110740"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=110740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}