{"id":107382,"date":"2023-03-22T12:48:15","date_gmt":"2023-03-22T10:48:15","guid":{"rendered":"https:\/\/prohoster.info\/?p=107382"},"modified":"2023-03-22T16:30:23","modified_gmt":"2023-03-22T14:30:23","slug":"obnovlenie-flatpak-s-ustraneniem-dvuh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/obnovlenie-flatpak-s-ustraneniem-dvuh-uyazvimostej","title":{"rendered":"P\u00ebrdit\u00ebsim i Flatpak me eliminimin e dy cenueshm\u00ebrive","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Disponohen azhurnime korrigjuese p\u00ebr mjete ndihm\u00ebse p\u00ebr krijimin e pakove t\u00eb pavarura Flatpak 1.14.4, 1.12.8, 1.10.8 dhe 1.15.4 ku jan\u00eb eliminuar dy dob\u00ebsi: <\/p>\n
\n
CVE-2023-28100 \u2014 mund\u00ebsia p\u00ebr t\u00eb kopjuar dhe ngjitur tekst n\u00eb tamponin e hyrjes s\u00eb konsol\u00ebs virtuale p\u00ebrmes manipulimeve me ioctl TIOCLINUX gjat\u00eb instalimit t\u00eb nj\u00eb pakete flatpak t\u00eb p\u00ebrgatitur nga nj\u00eb sulmues. P\u00ebr shembull, kjo dob\u00ebsi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb organizuar ekzekutimin e komandave t\u00eb rast\u00ebsishme n\u00eb konsol\u00eb pas p\u00ebrfundimit t\u00eb procesit t\u00eb instalimit t\u00eb nj\u00eb pakete t\u00eb jashtme. Problemi ndodh vet\u00ebm n\u00eb konsol\u00ebn virtuale klasike (\/dev\/tty1, \/dev\/tty2, etj.) dhe nuk prek seancat n\u00eb xterm, gnome-terminal, Konsole dhe terminalet grafike t\u00eb tjera. Kjo dob\u00ebsi nuk \u00ebsht\u00eb specifike p\u00ebr flatpak dhe mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb sulmuar aplikacione t\u00eb tjera, p\u00ebr shembull, dob\u00ebsi t\u00eb ngjashme m\u00eb par\u00eb, q\u00eb lejojn\u00eb grumbullimin e karaktereve p\u00ebrmes nd\u00ebrfaqes ioctl TIOCSTI, jan\u00eb gjetur n\u00eb \/bin\/sandbox dhe snap.\n
CVE-2023-28101 \u2014 mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur sekuenca escape n\u00eb list\u00ebn e privilegjeve n\u00eb metadatat e paket\u00ebs p\u00ebr t\u00eb fshehur informacionin q\u00eb shfaqet n\u00eb terminal mbi privilegjet e zgjeruara t\u00eb k\u00ebrkuara gjat\u00eb instalimit ose p\u00ebrdit\u00ebsimit t\u00eb paket\u00ebs p\u00ebrmes nd\u00ebrfaqes s\u00eb komand\u00ebs. Sulmuesit mund t\u00eb abuzojn\u00eb me k\u00ebt\u00eb dob\u00ebsi p\u00ebr t\u00eb mashtruar p\u00ebrdoruesit mbi privilegjet q\u00eb p\u00ebrdoren n\u00eb paket\u00eb. Nd\u00ebrfaqet grafike p\u00ebr instalimin e paketimeve Flatpak, si GNOME Software dhe KDE Plasma Discover, nuk jan\u00eb t\u00eb prekur nga ky problem. <\/ul>\n