{"id":184011,"date":"2026-10-27T11:40:44","date_gmt":"2026-10-27T09:40:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimosti-v-rust-bibliotekah-zip-rs-i-librsvg"},"modified":"2026-10-27T11:40:49","modified_gmt":"2026-10-27T09:40:49","slug":"vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een bibliotecile Rust zip-rs \u0219i librsvg","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen biblioteca zip-rs, scris\u0103 \u00een limbajul Rust \u0219i av\u00e2nd aproximativ 10 milioane de desc\u0103rc\u0103ri pe s\u0103pt\u0103m\u00e2n\u0103, a fost identificat\u0103 o vulnerabilitate (CVE-2026-115905) care permite crearea de arhive ce par inofensive, dar care, la decompresie, extrag alte fi\u0219iere care nu au fost ini\u021bial afi\u0219ate \u00een list\u0103. Fi\u0219ierele pot fi plasate \u00een arhiv\u0103 \u00een afara structurii \u201eCentral Directory\u201d, ceea ce face ca, la vizualizarea listei de fi\u0219iere, s\u0103 fie afi\u0219at un con\u021binut, dar la decompresie prin API-ul ZipStreamReader s\u0103 se extrag\u0103 alte fi\u0219iere. Problema a fost clasat\u0103 cu un nivel de severitate de 10 din 10. Vulnerabilitatea a fost corectat\u0103 \u00een versiunea zip-rs 9.0.5.<\/p>\n

Vulnerabilitatea este cauzat\u0103 de utilizarea unor antete diferite \u00een accesul arbitrar la arhiv\u0103 prin intermediul API-ului ZipArchive \u0219i la extragerea datelor \u00een mod streaming prin API-ul ZipStreamReader. Handlerul ZipArchive se bazeaz\u0103 pe antetul CDFH (Central Directory File Header), \u00een timp ce ZipStreamReader consider\u0103 la extragerea fi\u0219ierelor antetul LFH (Local File Header) ca fiind mai prioritar f\u0103r\u0103 sincronizarea metadatelor dublate.<\/p>\n

Vulnerabilitatea poate fi utilizat\u0103 pentru a ocoli filtrele de e-mail, scanerele antivirus \u0219i alte sisteme de verificare a securit\u0103\u021bii. Atacatorul poate plasa \u00een partea vizibil\u0103 a arhivei un document sau o imagine \u0219i, \u00een partea ascuns\u0103, poate include un fi\u0219ier executabil cu cod mali\u021bios, care nu va fi detectat de antivirus, dar va fi salvat pe disc la dezarhivare de c\u0103tre utilizator. Exemplele includ atacuri asupra microserviciilor, platformelor SaaS \u0219i sistemelor de izolare a containerelor, \u00een timpul c\u0103rora, la dezarhivarea arhivelor, cum ar fi seturi de stiluri, fi\u0219iere text sau imagini, care nu prezint\u0103 pericol \u00een directoarele cu proiecte active, pot fi suprascrise scripturi \u0219i fi\u0219iere executabile.<\/p>\n

De asemenea, merit\u0103 men\u021bionat\u0103 vulnerabilitatea (CVE-2026-96889) din biblioteca librsvg, dezvoltat\u0103 de proiectul GNOME \u00een limbajul Rust. Biblioteca este utilizat\u0103 \u00een GTK \u0219i aplica\u021biile GNOME pentru randarea SVG-urilor \u0219i este, de asemenea, implicat\u0103 \u00een popularul pachet NPM sharp, care are 80 de milioane de desc\u0103rc\u0103ri pe s\u0103pt\u0103m\u00e2n\u0103 \u0219i este folosit ca dependen\u021b\u0103 de aproape 11 mii de proiecte. Vulnerabilitatea permite executarea de cod personalizat la procesarea unor imagini SVG special concepute. Problema a fost solu\u021bionat\u0103 \u00een versiunile librsvg 2.56.6, 2.60.3, 2.62.4 \u0219i 2.63.1, precum \u0219i \u00een pachetul NPM sharp 0.35.5. Printre proiectele afectate se num\u0103r\u0103 platforma PeerTube (dependen\u021ba a fost actualizat\u0103 \u00een lansarea de ast\u0103zi PeerTube 8.3.2).<\/p>\n

Pentru analiza markup-ului XML folosit \u00een fi\u0219ierele SVG, librsvg utilizeaz\u0103 func\u021bii din biblioteca C libxml2. Vulnerabilitatea este cauzat\u0103 de faptul c\u0103, \u00een cazul \u00een care \u00een SVG exist\u0103 structuri XML \u00eennodat cu Xincludes, ce con\u021bin elemente duplicate cu nume repetitive, se produce un acces la memorie dup\u0103 eliberarea acesteia. E\u0219ecul apare deoarece biblioteca librsvg elibereaz\u0103 memoria pentru elementele XML care sunt \u00eenc\u0103 utilizate \u00een parser-ul libxml2.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zip-rs, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043e\u043a\u043e\u043b\u043e 10 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-115905), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0430\u0440\u0445\u0438\u0432\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c\u0438, \u043d\u043e \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0438\u0437 \u043d\u0438\u0445 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435, \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043d\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435, \u0444\u0430\u0439\u043b\u044b. \u0424\u0430\u0439\u043b\u044b \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432 \u0430\u0440\u0445\u0438\u0432\u0435 \u0432\u043d\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b «Central Directory», \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u043f\u0440\u0438 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0435 \u0441\u043f\u0438\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184011","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een bibliotecile Rust zip-rs \u0219i librsvg | ProHoster","description":"\u00cen biblioteca zip-rs, scris\u0103 \u00een limbajul Rust \u0219i care are aproximativ 10 milioane de desc\u0103rc\u0103ri pe s\u0103pt\u0103m\u00e2n\u0103, a fost identificat\u0103 o vulnerabilitate (CVE-2026-115905) care permite crearea unor arhive care par inofensive, dar care, la dezarhivare, pot cauza probleme.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Rust-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 zip-rs \u0438 librsvg | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zip-rs, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043e\u043a\u043e\u043b\u043e 10 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-115905), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0430\u0440\u0445\u0438\u0432\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c\u0438, \u043d\u043e \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0438\u0437.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-27T09:40:44+00:00","article:modified_time":"2026-10-27T09:40:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=184011"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184011\/revisions"}],"predecessor-version":[{"id":184012,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184011\/revisions\/184012"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=184011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=184011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=184011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}