{"id":120155,"date":"2024-10-12T19:09:14","date_gmt":"2024-10-12T17:09:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-libarchive-privodyashhie-k-povrezhdeniyu-pamyati"},"modified":"2024-10-12T19:09:14","modified_gmt":"2024-10-12T17:09:14","slug":"uyazvimosti-v-libarchive-privodyashhie-k-povrezhdeniyu-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimosti-v-libarchive-privodyashhie-k-povrezhdeniyu-pamyati","title":{"rendered":"Vulnerabilit\u00e0 in Libarchive che portano a un danneggiamento della memoria","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nella libreria Libarchive, che fornisce funzioni per lavorare con vari formati di archivi e file compressi, sono state individuate vulnerabilit\u00e0 che portano a un overflow del buffer durante l'elaborazione di archivi formattati in modo specifico nel formato RAR. Le vulnerabilit\u00e0 sono presenti nelle funzioni execute_filter_audio (CVE-2024-48957) e execute_filter_delta (CVE-2024-48958) e sono causate dalla mancanza di controllo che il blocco «src» possa sovrapporsi al blocco «dst» in archivi danneggiati. <\/p>\n

Le vulnerabilit\u00e0 sono state risolte nella versione Libarchive 3.7.5, che ha anche corretto oltre una dozzina di bug che portavano a un overflow del buffer, accesso a memoria gi\u00e0 liberata o overflow aritmetici durante l'elaborazione di file nei formati cpio, lzop, rpm, zip, uu e rar. Le correzioni sono state contrassegnate come problemi di sicurezza, ma senza l'assegnazione di identificatori CVE. Non \u00e8 ancora chiaro se questi problemi possano essere sfruttati per eseguire codice durante l'elaborazione di file appositamente formattati. <\/p>\n

Libarchive viene utilizzato come dipendenza in molti pacchetti popolari, ad esempio in smbclient, flatpak, appstream, libappimage, dpdk, cmake, rpm, nix, pacman, elfutils, unrar, claws-mail, ark, epiphany, evince, vagrant, vlc, mpv, gvfs, fwupd, systemd (opzionale) e file-roller (gestore di archivi in GNOME). \u00c8 possibile tenere traccia degli aggiornamenti nelle distribuzioni sulle seguenti pagine: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libarchive, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u043c\u0438 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0441\u0436\u0430\u0442\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0432\u044b\u0445\u043e\u0434\u0443 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RAR. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 execute_filter_audio (CVE-2024-48957) \u0438 execute_filter_delta (CVE-2024-48958) \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0447\u0442\u043e \u0431\u043b\u043e\u043a «src» \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0431\u043b\u043e\u043a «dst» \u0432 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0451\u043d\u043d\u044b\u0445 \u0430\u0440\u0445\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120155","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in Libarchive che portano a danneggiamento della memoria | ProHoster","description":"Nella libreria Libarchive, che fornisce funzioni per lavorare con vari formati di archivi e file compressi, sono state scoperte vulnerabilit\u00e0 che portano a un overflow del buffer durante l'elaborazione di archivi RAR appositamente formati. Le vulnerabilit\u00e0 sono presenti nelle funzioni execute_filter_audio (CVE-2024-48957) ed execute_filter_delta (CVE-2024-48958) e sono causate dalla mancanza di verifica che il blocco \"src\" possa sovrapporsi al blocco \"dst\" negli archivi danneggiati. Le vulnerabilit\u00e0 sono state risolte.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimosti-v-libarchive-privodyashhie-k-povrezhdeniyu-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Libarchive, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libarchive, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u043c\u0438 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0441\u0436\u0430\u0442\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0432\u044b\u0445\u043e\u0434\u0443 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RAR. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 execute_filter_audio (CVE-2024-48957) \u0438 execute_filter_delta (CVE-2024-48958) \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0447\u0442\u043e \u0431\u043b\u043e\u043a "src" \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0431\u043b\u043e\u043a "dst" \u0432 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0451\u043d\u043d\u044b\u0445 \u0430\u0440\u0445\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimosti-v-libarchive-privodyashhie-k-povrezhdeniyu-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-12T17:09:14+00:00","article:modified_time":"2024-10-12T17:09:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120155","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 07:16:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:16:19","updated":"2026-01-23 07:16:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/120155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=120155"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/120155\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=120155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=120155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=120155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}