{"id":110740,"date":"2023-10-11T15:10:19","date_gmt":"2023-10-11T13:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda"},"modified":"2023-10-11T15:10:19","modified_gmt":"2023-10-11T13:10:19","slug":"uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","title":{"rendered":"Luki w bibliotekach X.Org, z kt\u00f3rych dwie istniej\u0105 od 1988 roku","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Opublikowano informacje o pi\u0119ciu lukach w bibliotekach libX11 i libXpm, rozwijanych przez projekt X.Org. Problemy zosta\u0142y rozwi\u0105zane w wydaniach libXpm 3.5.17 i libX11 1.8.7. Trzy luki odkryto w bibliotece libX11, kt\u00f3ra oferuje funkcje z realizacj\u0105 protoko\u0142u X11 po stronie klienta:   <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-43785 \u2014 przepe\u0142nienie bufora w kodzie libX11, kt\u00f3re objawia si\u0119 podczas przetwarzania odpowiedzi z serwera X, przy liczbie znak\u00f3w niezgodnej z wcze\u015bniej wys\u0142anym zapytaniem XkbGetMap. W podatno\u015bci tej wyst\u0119puje b\u0142\u0105d w X11R6.1, obecny od 1996 roku. Mo\u017ce by\u0107 ona wykorzystana podczas \u0142\u0105czenia aplikacji u\u017cywaj\u0105cej libx11 z z\u0142o\u015bliwym serwerem X lub po\u015brednim proxy kontrolowanym przez atakuj\u0105cego.\n<li class=\"l\"> CVE-2023-43786 \u2014 wyczerpanie stosu w wyniku niesko\u0144czonej rekurencji w funkcji PutSubImage() w libX11, kt\u00f3re wyst\u0119puje podczas przetwarzania specjalnie przygotowanych danych w formacie XPM. Podatno\u015b\u0107 ta istnieje od momentu wydania X11R2 w lutym 1988 roku.\n<li class=\"l\"> CVE-2023-43787 \u2014 przepe\u0142nienie ca\u0142kowite w funkcji XCreateImage() w libX11, prowadz\u0105ce do przepe\u0142nienia sterty z powodu b\u0142\u0119du w obliczaniu rozmiaru, kt\u00f3ry nie odpowiada rzeczywistemu rozmiarowi danych. Problemowa funkcja XCreateImage() jest wywo\u0142ywana z funkcji XpmReadFileToPixmap(), co umo\u017cliwia wykorzystanie podatno\u015bci podczas przetwarzania specjalnie przygotowanego pliku w formacie XPM. Podatno\u015b\u0107 ta r\u00f3wnie\u017c istnieje od czas\u00f3w X11R2 (1988 rok).    <\/ul>\n<p>Ponadto ujawniono dwie luki w bibliotece libXpm (CVE-2023-43788 i CVE-2023-43789), spowodowane mo\u017cliwo\u015bci\u0105 odczytu z obszar\u00f3w poza granicami przydzielonej pami\u0119ci. Problemy objawiaj\u0105 si\u0119 przy \u0142adowaniu komentarza z bufora w pami\u0119ci i przetwarzaniu pliku XPM z nieprawid\u0142ow\u0105 map\u0105 kolor\u00f3w. Obie luki datowane s\u0105 na 1998 rok i zosta\u0142y znalezione dzi\u0119ki zastosowaniu narz\u0119dzi do wykrywania b\u0142\u0119d\u00f3w w pami\u0119ci oraz testowania fuzzingowego AddressSanitizer i libFuzzer.        <\/p>\n<p>X.org ma historyczne problemy z bezpiecze\u0144stwem, na przyk\u0142ad dziesi\u0119\u0107 lat temu, na 30. konferencji Chaos Communication Congress (CCC) w prezentacji badacza bezpiecze\u0144stwa Ilji van Sprundela po\u0142owa wyst\u0105pienia po\u015bwi\u0119cona by\u0142a problemom z <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pl\/server\/dts-newyork\/\"   title=\"serwerze\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2764\">serwerze<\/a> X.Org oraz druga po\u0142owa bezpiecze\u0144stwa bibliotek klienckich X11. W raporcie Ilyi, kt\u00f3ry w 2013 roku ujawni\u0142 30 podatno\u015bci dotycz\u0105cych r\u00f3\u017cnych bibliotek klienckich X11 oraz komponent\u00f3w DRI Mesa, znalaz\u0142y si\u0119 emocjonalne wypowiedzi, takie jak \u201eGLX \u2014 to okropny demotywator! 80 000 linii czystego przera\u017cenia!\u201d oraz \u201eW ci\u0105gu ostatnich kilku miesi\u0119cy znalaz\u0142em w nim 120 b\u0142\u0119d\u00f3w, a jeszcze nie sko\u0144czy\u0142em sprawdzania.\u201d<br \/>\n<br \/>\u0179r\u00f3d\u0142o: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59906\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7. \u0422\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libx11, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 X11: CVE-2023-43785 &#8212; \u0432\u044b\u0445\u043e\u0434 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u043e\u0434\u0435 libX11, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u0442\u0432\u0435\u0442\u0430 \u043e\u0442 X-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441 \u0447\u0438\u0441\u043b\u043e\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432, \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110740","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 X.Org, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0441 1988 \u0433\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-10-11T13:10:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-10-11T13:10:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luki w bibliotekach X.Org, z kt\u00f3rych dwie obecne s\u0105 od 1988 roku | ProHoster","description":"Opublikowano informacje o pi\u0119ciu lukach w bibliotekach libX11 i libXpm, rozwijanych przez projekt X.Org. Problemy zosta\u0142y naprawione w wydaniach libXpm 3.5.17 i libX11 1.8.7.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 X.Org, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0441 1988 \u0433\u043e\u0434\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 libX11 \u0438 libXpm, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 libXpm 3.5.17 \u0438 libX11 1.8.7.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-bibliotekah-x-org-dve-iz-kotoryh-prisutstvuyut-s-1988-goda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-11T13:10:19+00:00","article:modified_time":"2023-10-11T13:10:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110740","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:40:03","updated":"2026-02-09 21:40:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/110740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=110740"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/110740\/revisions"}],"predecessor-version":[{"id":160044,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/110740\/revisions\/160044"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=110740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=110740"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=110740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}