{"id":137924,"date":"2025-06-21T23:12:01","date_gmt":"2025-06-21T21:12:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda"},"modified":"2025-06-21T23:12:01","modified_gmt":"2025-06-21T21:12:01","slug":"uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een biblioteca libxml2, care pot conduce la execu\u021bia codului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen biblioteca Libxml2, dezvoltat\u0103 de proiectul GNOME \u0219i utilizat\u0103 pentru analiza con\u021binutului \u00een format XML, au fost identificate 5 vulnerabilit\u0103\u021bi, dou\u0103 dintre acestea av\u00e2nd poten\u021bialul de a duce la executarea de cod la procesarea unor date externe special formate. Biblioteca Libxml2 este larg r\u0103sp\u00e2ndit\u0103 \u00een proiecte open source \u0219i, de exemplu, este utilizat\u0103 ca dependen\u021b\u0103 \u00een peste 800 de pachete din compunerea Ubuntu. <\/p>\n

Prima vulnerabilitate (CVE-2025-6170) este cauzat\u0103 de o dep\u0103\u0219ire a buffer-ului \u00een implementarea shell-ului interactiv xmllint, utilizat pentru analiza fi\u0219ierelor XML. Dep\u0103\u0219irea apare la procesarea unor argumente de comand\u0103 foarte lungi din cauza absen\u021bei unei verific\u0103ri corecte a dimensiunii datelor de intrare \u00eenainte de copierea datelor de c\u0103tre func\u021bia strcpy(). Pentru a exploata vulnerabilitatea, atacatorul trebuie s\u0103 aib\u0103 capacitatea de a influen\u021ba comenzile transmise utilitarului xmllint. Un patch pentru remedierarea vulnerabilit\u0103\u021bii nu este disponibil momentan. <\/p>\n

A doua vulnerabilitate (CVE-2025-6021) este prezent\u0103 \u00een implementarea func\u021biei xmlBuildQName() \u0219i duce la scrierea de date dincolo de buffer din cauza unei dep\u0103\u0219iri \u00eentregi la calcularea dimensiunii buffer-ului pe baza prefixului \u0219i numelui local. Pentru a exploata vulnerabilitatea, atacatorul trebuie s\u0103 reu\u0219easc\u0103 s\u0103 injecteze propriile date \u00een argumentele prefix \u0219i ncname transmise func\u021biei xmlBuildQName(). Un patch a fost preg\u0103tit pentru aceast\u0103 vulnerabilitate. Corectarea a fost inclus\u0103 \u00een versiunea libxml2 2.14.4. Starea noii versiuni a pachetului sau preg\u0103tirea corect\u0103rii \u00een distribu\u021bii poate fi verificat\u0103 pe urm\u0103toarele pagini (dac\u0103 pagina nu este disponibil\u0103, \u00eenseamn\u0103 c\u0103 dezvoltatorii distribu\u021biei nu au \u00eenceput \u00eenc\u0103 s\u0103 abordeze problema): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo \u0219i Arch (1, 2). <\/p>\n

Celelalte trei probleme duc la o terminare nea\u0219teptat\u0103 din cauza acces\u0103rii unei zone de memorie deja eliberate \u00een func\u021bia xmlSchematronGetNode (CVE-2025-49794), dereferentierea unui pointer nul \u00een func\u021bia xmlXPathCompiledEval (CVE-2025-49795) \u0219i gestionarea incorect\u0103 a tipurilor (Type Confusion) \u00een func\u021bia xmlSchematronFormatReport (CVE-2025-49796). Pentru remedierea acestor vulnerabilit\u0103\u021bi se ia \u00een considerare posibilitatea elimin\u0103rii suportului pentru limbajul de marcare Schematron din libxml2. <\/p>\n

Se remarc\u0103 de asemenea existen\u021ba a trei vulnerabilit\u0103\u021bi nerezolvate \u00een biblioteca libxslt, care nu mai are suport. Informa\u021biile despre aceste probleme nu sunt \u00eenc\u0103 dezv\u0103luite \u0219i sunt programate pentru publicare pe 9 iulie, 13 iulie \u0219i 6 august. Vulnerabilit\u0103\u021bile nerezolvate \u0219i care nu sunt publicate sunt de asemenea notate \u00een proiectele asociate cu GNOME, precum gvfs, libgxps, gdm, glib, GIMP \u0219i libsoup. <\/p>\n

Supplementar: \u00centre\u021bin\u0103torul libxml2 a declarat c\u0103, de acum \u00eenainte, va considera vulnerabilit\u0103\u021bile ca fiind erori obi\u0219nuite, f\u0103r\u0103 a le face mai prioritare, corect\u00e2ndu-le atunci c\u00e2nd are timp liber \u0219i dezv\u0103luind imediat informa\u021biile despre natura vulnerabilit\u0103\u021bii, f\u0103r\u0103 a impune un embargou \u0219i oferind timp pentru remedieri \u00een produsele externe.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Libxml2 \u0448\u0438\u0440\u043e\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 \u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Ubuntu. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-6170) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-137924","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een biblioteca libxml2, ce pot duce poten\u021bial la execu\u021bia de cod | ProHoster","description":"\u00cen biblioteca Libxml2, dezvoltat\u0103 de proiectul GNOME \u0219i utilizat\u0103 pentru analizarea con\u021binutului \u00een format XML, au fost identificate 5 vulnerabilit\u0103\u021bi, dintre care dou\u0103 ar putea duce poten\u021bial la execu\u021bia de cod \u00een urma proces\u0103rii specializate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libxml2, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-21T21:12:01+00:00","article:modified_time":"2025-06-21T21:12:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"137924","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:23:11","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:23:11","updated":"2026-01-23 13:23:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/137924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=137924"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/137924\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=137924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=137924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=137924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}