{"id":37147,"date":"2019-10-31T22:16:00","date_gmt":"2019-10-31T19:16:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novaya-uyazvimost-v-ghostscript\/"},"modified":"2019-10-31T22:16:00","modified_gmt":"2019-10-31T19:16:00","slug":"novaya-uyazvimost-v-ghostscript","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/novaya-uyazvimost-v-ghostscript","title":{"rendered":"Nova ranljivost v Ghostscript","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zaporedje ranljivosti se ne ustavi (1<\/a><\/noindex>, 2<\/a><\/noindex>, 3<\/a><\/noindex>, 4<\/a><\/noindex>, 5<\/a><\/noindex>, 6<\/a><\/noindex>) u Ghostscriptu<\/a><\/noindex>, niz orodij za obdelavo, pretvorbo in generiranje dokumentov v formatih PostScript in PDF. Tako kot prej\u0161nje ranljivosti nova te\u017eava<\/a><\/noindex> (CVE-2019-10216<\/a><\/noindex>) omogo\u010da ob obdelavi posebej oblikovanih dokumentov obiti na\u010din izolacije «-dSAFER» (prek manipulacij z «.buildfont1») in pridobiti dostop do vsebine FS, kar se lahko uporabi za organizacijo napada za izvajanje poljubne kode v sistemu (na primer, prek dodajanja ukazov v ~\\\/ .bashrc ali ~\\\/ .profile). Popravek je na voljo v obliki popravka<\/a><\/noindex>. O posodobitvah paketov v distribucijah lahko spremljate na teh straneh: Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, RHEL<\/a><\/noindex>, Arch<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. <\/p>\n

Spomnimo, da ranljivosti v Ghostscript predstavljajo pove\u010dano tveganje, ker se to orodje uporablja v mnogih priljubljenih aplikacijah za obdelavo formatov PostScript in PDF. Na primer, Ghostscript se uporablja pri ustvarjanju miniatur na namizju, pri ozadnji indeksaciji podatkov in pri pretvorbi slik. Za uspe\u0161en napad je v mnogih primerih dovolj, da preprosto nalo\u017eite datoteko z izkori\u0161\u010danjem ali si ogledate imenik z njo v Nautilusu. Ranljivosti v Ghostscript lahko tudi izkori\u0161\u010date preko obdelovalnikov slik, ki temeljijo na paketih ImageMagick in GraphicsMagick, tako da jim posredujete JPEG ali PNG datoteko, v kateri namesto slike le\u017ei koda PostScript (ta datoteka bo obdelana v Ghostscript, ker MIME tip prepozna po vsebini in se ne zana\u0161a na kon\u010dnico). <\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0434\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (1, 2, 3, 4, 5, 6) \u0432 Ghostscript, \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 PostScript \u0438 PDF. \u041a\u0430\u043a \u0438 \u043f\u0440\u043e\u0448\u043b\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2019-10216) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043e\u0431\u043e\u0439\u0442\u0438 \u0440\u0435\u0436\u0438\u043c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 «-dSAFER» (\u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 «.buildfont1») \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u0424\u0421, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37147","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nova ranljivost v Ghostscript | ProHoster","description":"Zaporedje ranljivosti se ne ustavi (1,","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/novaya-uyazvimost-v-ghostscript","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Ghostscript | ProHoster","og:description":"\u041d\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0434\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (1,","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/novaya-uyazvimost-v-ghostscript","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:00+00:00","article:modified_time":"2019-10-31T19:16:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37147","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 06:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:32:14","updated":"2026-01-22 06:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=37147"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37147\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=37147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=37147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=37147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}