{"id":113095,"date":"2024-01-24T11:28:09","date_gmt":"2024-01-24T09:28:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-utilite-gnu-split-privodyashhaya-k-perepolneniyu-bufera"},"modified":"2024-01-24T11:28:09","modified_gmt":"2024-01-24T09:28:09","slug":"uyazvimost-v-utilite-gnu-split-privodyashhaya-k-perepolneniyu-bufera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-utilite-gnu-split-privodyashhaya-k-perepolneniyu-bufera","title":{"rendered":"Sebezhet\u0151s\u00e9g a GNU split seg\u00e9dprogramj\u00e1ban, amely puffert\u00falcsordul\u00e1shoz vezet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A split utility, included in the GNU coreutils package and used for dividing large files into parts, has been found to have a vulnerability (CVE-2024-0684) that leads to a buffer overflow when processing long lines (several hundred bytes) if the «—line-bytes» option («-C») is used in split. The vulnerability was discovered during analysis of crashes that occurred when using the split utility to divide data transmitted via QR codes. <\/p>\n
The vulnerability is caused by an error made in the coreutils 7.2 release when the xrealloc function call was replaced with xpalloc. A patch with the fix has already been accepted into the codebase, but a new version with the fix has not yet been released. An example file that triggers the overflow when running «split -C 1024 .\\\/split_me» has been published to demonstrate the vulnerability. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"