{"id":184011,"date":"2026-10-27T11:40:44","date_gmt":"2026-10-27T09:40:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimosti-v-rust-bibliotekah-zip-rs-i-librsvg"},"modified":"2026-10-27T11:40:49","modified_gmt":"2026-10-27T09:40:49","slug":"vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","title":{"rendered":"Zranite\u013enosti v Rust kni\u017eniciach zip-rs a librsvg","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kni\u017enici zip-rs, nap\u00edsanej v jazyku Rust a s pribli\u017ene 10 mili\u00f3nmi stiahnut\u00ed t\u00fd\u017edenne, bola odhalen\u00e1 zranite\u013enos\u0165 (CVE-2026-115905), ktor\u00e1 umo\u017e\u0148uje vytv\u00e1ra\u0165 arch\u00edvy, ktor\u00e9 vyzeraj\u00fa ne\u0161kodne, ale pri rozba\u013eovan\u00ed z nich s\u00fa vy extrahovan\u00e9 in\u00e9 s\u00fabory, ktor\u00e9 p\u00f4vodne nie s\u00fa uveden\u00e9 v zozname. S\u00fabory m\u00f4\u017eu by\u0165 umiestnen\u00e9 v arch\u00edve mimo \u0161trukt\u00fary «Central Directory», preto pri prezeran\u00ed zoznamu s\u00faborov sa zobrazuje in\u00fd obsah, ale pri rozba\u013eovan\u00ed cez API ZipStreamReader s\u00fa extrahovan\u00e9 in\u00e9 s\u00fabory. Probl\u00e9mu bol pridelen\u00fd stupe\u0148 nebezpe\u010denstva 10 z 10. Zranite\u013enos\u0165 bola opraven\u00e1 vo verzii zip-rs 9.0.5.<\/p>\n

Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 pou\u017eit\u00edm r\u00f4znych hlavi\u010diek pri \u013eubovo\u013enom pr\u00edstupe k arch\u00edvu pomocou API ZipArchive a pri extrakcii d\u00e1t v streamovom re\u017eime pomocou API ZipStreamReader. Spracovate\u013e ZipArchive sa spolieha na hlavi\u010dku CDFH (Central Directory File Header), zatia\u013e \u010do ZipStreamReader pri extrakcii s\u00faborov pova\u017euje za prioritnej\u0161iu hlavi\u010dku LFH (Local File Header) bez synchroniz\u00e1cie duplicitn\u00fdch metad\u00e1t.<\/p>\n

Zranite\u013enos\u0165 m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 na ob\u00eddenie po\u0161tov\u00fdch filtrov, antiv\u00edrusov\u00fdch skenerov a in\u00fdch syst\u00e9mov kontroly bezpe\u010dnosti. \u00dato\u010dn\u00edk m\u00f4\u017ee umiestni\u0165 do vidite\u013enej \u010dasti arch\u00edvu dokument alebo obr\u00e1zok, a do skrytej zahrn\u00fa\u0165 sp\u00fa\u0161\u0165ac\u00ed s\u00fabor s malv\u00e9rom, ktor\u00fd nebude detegovan\u00fd antiv\u00edrusom, ale bude zachovan\u00fd na disku pri rozbalen\u00ed pou\u017e\u00edvate\u013eom. Pr\u00edklady \u00fatokov sa uv\u00e1dzaj\u00fa na mikroservices, platformy SaaS a syst\u00e9my kontajnerovej izol\u00e1cie, pri ktor\u00fdch pri rozbalen\u00ed v adres\u00e1roch s pracovn\u00fdmi projektmi nepredstavuj\u00facimi nebezpe\u010denstvo, napr\u00edklad so \u0161t\u00fdlov\u00fdmi sadami, textov\u00fdmi s\u00fabormi alebo obr\u00e1zkami, m\u00f4\u017eu by\u0165 prep\u00edsan\u00e9 skripty a sp\u00fa\u0161\u0165acie s\u00fabory.<\/p>\n

Okrem toho je mo\u017en\u00e9 spomen\u00fa\u0165 zranite\u013enos\u0165 (CVE-2026-96889) v kni\u017enici librsvg, ktor\u00e1 je vyv\u00edjan\u00e1 projektom GNOME v jazyku Rust. Kni\u017enica sa pou\u017e\u00edva v GTK a aplik\u00e1ci\u00e1ch GNOME na vykres\u013eovanie SVG a je zapojen\u00e1 v ob\u013e\u00fabenom NPM bal\u00edku sharp, ktor\u00fd m\u00e1 80 mili\u00f3nov s\u0165ahovan\u00ed t\u00fd\u017edenne a je pou\u017e\u00edvan\u00fd ako z\u00e1vislos\u0165 takmer 11 tis\u00edc projektov. Zranite\u013enos\u0165 umo\u017e\u0148uje vykon\u00e1vanie vlastn\u00e9ho k\u00f3du pri spracovan\u00ed \u0161peci\u00e1lne vytvoren\u00fdch SVG obr\u00e1zkov. Probl\u00e9m bol odstr\u00e1nen\u00fd vo verzi\u00e1ch librsvg 2.56.6, 2.60.3, 2.62.4 a 2.63.1, ako aj v NPM bal\u00edku sharp 0.35.5. Medzi zasiahnut\u00fdmi projektmi bola platforma PeerTube (z\u00e1vislos\u0165 bola aktualizovan\u00e1 v dne\u0161nom vydan\u00ed PeerTube 8.3.2).<\/p>\n

Na anal\u00fdzu XML zna\u010dkovania pou\u017e\u00edvan\u00e9ho v SVG s\u00faboroch sa v librsvg pou\u017e\u00edvaj\u00fa funkcie z C kni\u017enice libxml2. Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 t\u00fdm, \u017ee ak existuj\u00fa v SVG vnoren\u00e9 XML kon\u0161trukcie Xincludes, ktor\u00e9 obsahuj\u00fa duplicovan\u00e9 prvky s opakuj\u00facimi sa n\u00e1zvami, doch\u00e1dza k pr\u00edstupu k pam\u00e4ti po jej uvo\u013enen\u00ed. Chyba nast\u00e1va, preto\u017ee kni\u017enica librsvg uvo\u013e\u0148uje pam\u00e4\u0165 pre XML prvky, ktor\u00e9 s\u00fa e\u0161te st\u00e1le pou\u017e\u00edvan\u00e9 v analyz\u00e1tore libxml2.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zip-rs, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043e\u043a\u043e\u043b\u043e 10 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-115905), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0430\u0440\u0445\u0438\u0432\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c\u0438, \u043d\u043e \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0438\u0437 \u043d\u0438\u0445 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435, \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043d\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435, \u0444\u0430\u0439\u043b\u044b. \u0424\u0430\u0439\u043b\u044b \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432 \u0430\u0440\u0445\u0438\u0432\u0435 \u0432\u043d\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b «Central Directory», \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u043f\u0440\u0438 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0435 \u0441\u043f\u0438\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184011","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v Rust kni\u017eniciach zip-rs a librsvg | ProHoster","description":"V kni\u017enici zip-rs, nap\u00edsanej v jazyku Rust a s pribli\u017ene 10 mili\u00f3nmi s\u0165ahovan\u00ed t\u00fd\u017edenne, bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2026-115905), ktor\u00e1 umo\u017e\u0148uje vytv\u00e1ra\u0165 arch\u00edvy, ktor\u00e9 vyzeraj\u00fa ne\u0161kodne, ale pri rozba\u013eovan\u00ed zlyhaj\u00fa.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Rust-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 zip-rs \u0438 librsvg | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zip-rs, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043e\u043a\u043e\u043b\u043e 10 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-115905), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0430\u0440\u0445\u0438\u0432\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c\u0438, \u043d\u043e \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0438\u0437.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/vulnerabilities-in-rust-libraries-zip-rs-and-librsvg","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-27T09:40:44+00:00","article:modified_time":"2026-10-27T09:40:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/184011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=184011"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/184011\/revisions"}],"predecessor-version":[{"id":184012,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/184011\/revisions\/184012"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=184011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=184011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=184011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}