{"id":37676,"date":"2019-10-31T22:18:59","date_gmt":"2019-10-31T19:18:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ocherednye-4-uyazvimosti-v-ghostscript\/"},"modified":"2019-10-31T22:18:59","modified_gmt":"2019-10-31T19:18:59","slug":"ocherednye-4-uyazvimosti-v-ghostscript","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/ocherednye-4-uyazvimosti-v-ghostscript","title":{"rendered":"\u0160e \u0161tiri ranljivosti v Ghostscriptu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Po dveh tednih od odkritja<\/a><\/noindex> prej\u0161nje kriti\u010dne te\u017eave v Ghostscriptu<\/a><\/noindex> so bili odkriti<\/a><\/noindex> \u0161e \u0161tiri podobne ranljivosti (CVE-2019-14811, CVE-2019-14812, CVE-2019-14813, CVE-2019-14817), ki omogo\u010dajo obhod izolacijskega re\u017eima '-dSAFER' preko ustvarjanja povezave do '.forceput'. Pri obdelavi posebej oblikovanih dokumentov napadalec lahko pridobi dostop do vsebine datote\u010dnega sistema in dose\u017ee izvedbo poljubne kode v sistemu (na primer preko dodajanja ukazov v ~\/ .bashrc ali ~\/ .profile). Popravilo je na voljo v obliki popravkov.1<\/a><\/noindex>, 2<\/a><\/noindex>). Sproti lahko spremljate objavo posodobitev paketov v distribucijah na naslednjih straneh: Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, RHEL<\/a><\/noindex>, Arch<\/a><\/noindex>, ROSA<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. <\/p>\n

Spomnimo, da ranljivosti v Ghostscript predstavljajo pove\u010dano tveganje, ker se to orodje uporablja v mnogih priljubljenih aplikacijah za obdelavo formatov PostScript in PDF. Na primer, Ghostscript se uporablja pri ustvarjanju miniatur na namizju, pri ozadnji indeksaciji podatkov in pri pretvorbi slik. Za uspe\u0161en napad je v mnogih primerih dovolj, da preprosto nalo\u017eite datoteko z izkori\u0161\u010danjem ali si ogledate imenik z njo v Nautilusu. Ranljivosti v Ghostscript lahko tudi izkori\u0161\u010date preko obdelovalnikov slik, ki temeljijo na paketih ImageMagick in GraphicsMagick, tako da jim posredujete JPEG ali PNG datoteko, v kateri namesto slike le\u017ei koda PostScript (ta datoteka bo obdelana v Ghostscript, ker MIME tip prepozna po vsebini in se ne zana\u0161a na kon\u010dnico).<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043f\u0443\u0441\u0442\u044f \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 Ghostscript \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0435\u0449\u0451 4 \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-14811, CVE-2019-14812, CVE-2019-14813, CVE-2019-14817), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 «.forceput» \u043e\u0431\u043e\u0439\u0442\u0438 \u0440\u0435\u0436\u0438\u043c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 «-dSAFER». \u041f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u0424\u0421 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37676","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0160e \u0161tiri ranljivosti v Ghostscriptu | ProHoster","description":"Po dveh tednih od odkritja prej\u0161nje kriti\u010dne te\u017eave v","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/ocherednye-4-uyazvimosti-v-ghostscript","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0447\u0435\u0440\u0435\u0434\u043d\u044b\u0435 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Ghostscript | ProHoster","og:description":"\u0421\u043f\u0443\u0441\u0442\u044f \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/ocherednye-4-uyazvimosti-v-ghostscript","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:18:59+00:00","article:modified_time":"2019-10-31T19:18:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37676","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 18:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:22:29","updated":"2026-01-23 18:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37676","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=37676"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37676\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=37676"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=37676"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=37676"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}