{"id":111788,"date":"2023-11-27T15:10:15","date_gmt":"2023-11-27T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos"},"modified":"2023-11-27T15:10:15","modified_gmt":"2023-11-27T13:10:15","slug":"uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","title":{"rendered":"Vulnerabilit\u00e0 in Perl, ownCloud, GStreamer e Zephyr RTOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Alcune vulnerabilit\u00e0 recentemente scoperte:  <\/p>\n<ul>\n<li class=\"l\"> Nella versione correttiva di Perl 5.38.1 \u00e8 stata corretta una vulnerabilit\u00e0 (CVE-2023-47038) che pu\u00f2 portare alla scrittura di un byte oltre il buffer allocato durante l'elaborazione di espressioni regolari compilate con una propriet\u00e0 interna Unicode ridefinita in modo errato il cui nome inizia con \u00abutf8::perl\u00bb. Il problema si manifesta a partire dalla branca Perl 5.30.\n<p>Inoltre, in Perl 5.38.1 \u00e8 stata corretta una vulnerabilit\u00e0 specifica per la piattaforma Windows (CVE-2023-47039) che consente di eseguire codice personalizzato all'avvio di script se \u00e8 possibile posizionare un file cmd.exe nella directory corrente (a causa della mancanza di pulizia dei percorsi per la ricerca di file eseguibili, Perl tenta inizialmente di avviare cmd.exe nella directory corrente). Ad esempio, un aggressore pu\u00f2 posizionare il proprio cmd.exe nella cartella C:\\ProgramData e ottenere privilegi elevati se un amministratore esegue uno script Perl da questa cartella.    <\/p>\n<li class=\"l\"> Nella piattaforma cloud ownCloud, dalla quale nel 2016 si \u00e8 staccato il progetto Nextcloud, \u00e8 stata identificata una vulnerabilit\u00e0 (CVE-2023-49103) che interessa l'applicazione graphapi e consente di determinare il contenuto delle variabili d'ambiente, che potrebbero contenere la password di amministratore, la chiave di licenza e le credenziali per la connessione alla posta. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/server\/dts-shicago\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2915\">server<\/a>Il problema \u00e8 causato dall'uso in graphapi di una libreria di terze parti che, tra l'altro, fornisce un gestore GetPhpInfo.php, che chiama la funzione phpinfo(), il cui output contiene variabili d'ambiente.\n<li class=\"l\"> Nel framework multimediale GStreamer sono state rilevate due vulnerabilit\u00e0: CVE-2023-44446 \u2014 accesso alla memoria dopo la liberazione (Use-After-Free) nel codice di parsing dei file MXF; CVE-2023-44429 \u2014 overflow di buffer nel codice di parsing del formato AV1. Il primo problema \u00e8 causato dalla mancanza di controllo dell'oggetto prima di eseguire operazioni su di esso, e il secondo dalla mancanza di controllo delle dimensioni dei dati prima di copiarli in un buffer fisso. Le vulnerabilit\u00e0 possono portare all'esecuzione di codice dannoso quando si tenta di elaborare file MXF appositamente formattati e dati multimediali in formato AV1. Si segnala che i vettori di attacco dipendono dall'implementazione dell'applicazione attaccata. Le vulnerabilit\u00e0 sono state assegnate a un livello di gravit\u00e0 di 8.8 su 10. Le vulnerabilit\u00e0 sono state corrette nella versione GStreamer 1.22.7.\n<li class=\"l\"> Nel sistema operativo in tempo reale Zephyr RTOS sono state scoperte 25 vulnerabilit\u00e0, la maggior parte delle quali potrebbero potenzialmente portare all'esecuzione di codice da parte dell'attaccante. Le vulnerabilit\u00e0 sono causate da overflow di buffer in WiFi shell, stack Bluetooth, driver IPM, stack USB, driver IEEE 802.15.4, sottosistema Mgmt, sistema file, driver eS-WiFi e sottosistema CANbus. La maggior parte delle vulnerabilit\u00e0 \u00e8 stata risolta nella versione Zephyr 3.5.0, ma un problema (CVE-2023-4261) rimane non corretto (i dettagli su questa vulnerabilit\u00e0 non saranno pubblicati fino all'uscita della correzione).    <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60185\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Unicode-\u0441\u0432\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c, \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u043c\u0441\u044f \u043d\u0430 &#171;utf8::perl&#187;. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 Perl 5.30. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u0430\u044f \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111788","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in Perl, ownCloud, GStreamer e Zephyr RTOS | ProHoster","description":"Diverse vulnerabilit\u00e0 recentemente scoperte: nella versione correttiva di Perl 5.38.1 \u00e8 stata corretta una vulnerabilit\u00e0 (CVE-2023-47038) che potrebbe portare alla scrittura di un byte oltre il buffer allocato.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-27T13:10:15+00:00","article:modified_time":"2023-11-27T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111788","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:03","updated":"2026-02-09 21:42:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/111788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=111788"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/111788\/revisions"}],"predecessor-version":[{"id":160195,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/111788\/revisions\/160195"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=111788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=111788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=111788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}