{"id":116387,"date":"2024-06-06T15:39:51","date_gmt":"2024-06-06T13:39:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9"},"modified":"2024-06-06T15:39:51","modified_gmt":"2024-06-06T13:39:51","slug":"uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","title":{"rendered":"Cakt\u00ebsia n\u00eb zbatimet referuese t\u00eb kodek\u00ebve AV1 dhe VP8\/VP9","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb cakt\u00ebsi kritike (CVE-2024-5171) \u00ebsht\u00eb zbuluar n\u00eb bibliotek\u00ebn libaom, e zhvilluar nga aleanca Open Media (AOMedia), e cila ofron zbatimin referues t\u00eb formatit t\u00eb kodimit t\u00eb videos AV1. Kjo cakt\u00ebsi \u00e7on n\u00eb tejkalim t\u00eb numrave t\u00eb plot\u00eb dhe shkruan n\u00eb nj\u00eb hap\u00ebsir\u00eb jasht\u00eb kufijve t\u00eb tamponit gjat\u00eb p\u00ebrpunimit t\u00eb vlerave tep\u00ebr t\u00eb m\u00ebdha n\u00eb disa parametra. Nj\u00eb cakt\u00ebsi e ngjashme (CVE-2024-5197) \u00ebsht\u00eb zbuluar n\u00eb bibliotek\u00ebn libvpx me zbatime t\u00eb kodek\u00ebve VP8 dhe VP9. Problemet jan\u00eb rregulluar n\u00eb p\u00ebrdit\u00ebsimet libaom 3.9.0 dhe libvpx 1.14.1. N\u00eb distribucione, cakt\u00ebsit\u00eb ende mbeten t\u00eb pa rregulluara (Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD). <\/p>\n
Cakt\u00ebsit\u00eb n\u00eb libaom i \u00ebsht\u00eb caktuar niveli maksimal i rrezikut (10 nga 10), q\u00eb n\u00ebnkupton mund\u00ebsin\u00eb e shfryt\u00ebzimit gjat\u00eb p\u00ebrpunimit n\u00eb aplikacionet q\u00eb p\u00ebrdorin k\u00ebt\u00eb bibliotek\u00eb, p\u00ebrmbajtje t\u00eb dizajnuar posa\u00e7\u00ebrisht. N\u00eb libvpx, niveli i rrezikut \u00ebsht\u00eb caktuar n\u00eb 5.9 nga 10, q\u00eb p\u00ebrputhet me kushte t\u00eb kufizuara shfryt\u00ebzimi. Rreziku kryesor i cakt\u00ebsive n\u00eb libaom dhe libvpx \u00ebsht\u00eb p\u00ebr shkak se k\u00ebto biblioteka p\u00ebrdoren n\u00eb shfletues web, playera multimedia dhe sh\u00ebrbime q\u00eb kryejn\u00eb rikodim videosh. <\/p>\n
Dobitja e k\u00ebsaj r\u00ebnd\u00ebsie shfaqet n\u00eb libaom gjat\u00eb thirrjes s\u00eb funksioneve aom_img_alloc(), aom_img_wrap() ose om_img_alloc_with_border() me vlera t\u00eb m\u00ebdha n\u00eb parametrat d_w, d_h dhe align, t\u00eb cilat shkaktojn\u00eb mbip\u00ebrmbushje t\u00eb numrave t\u00eb plot\u00eb gjat\u00eb llogaritjes s\u00eb zhvendosjeve dhe p\u00ebrmasave t\u00eb bufferave. Nj\u00eb mbip\u00ebrmbushje e ngjashme ndodh n\u00eb funksionet vpx_img_alloc() dhe vpx_img_wrap(). K\u00ebto funksione p\u00ebrdoren gjat\u00eb kodimit t\u00eb videos. <\/p>\n
R\u00ebnd\u00ebsia m\u00eb e madhe e k\u00ebsaj dobie shfaqet p\u00ebr shkak t\u00eb mund\u00ebsis\u00eb s\u00eb mundshme t\u00eb sulmeve ndaj shfletuesve, n\u00eb t\u00eb cilat dob\u00ebsit\u00eb e ngjashme t\u00eb kaluara mund t\u00eb jen\u00eb shfryt\u00ebzuar p\u00ebrmes hapjes n\u00eb shfletues nj\u00eb faqeje t\u00eb dizajnuar ve\u00e7mas, q\u00eb th\u00ebrret funksione JavaScript p\u00ebr kodimin e videos, ose p\u00ebrmes manipulimeve me WebRTC. Sipas p\u00ebrfaq\u00ebsuesve t\u00eb Google, dob\u00ebsia nuk ndikon n\u00eb motorin Chromium, pasi n\u00eb funksionet aom_img_alloc(), aom_img_wrap(), vpx_img_alloc() dhe vpx_img_wrap() jan\u00eb kaluar vet\u00ebm vlera t\u00eb kontrolluara p\u00ebr argumentet d_w dhe d_h. N\u00eb Firefox, p\u00ebr dekodimin e AV1 p\u00ebrdoret biblioteka dav1d, por p\u00ebr kodimin p\u00ebrdoret libaom. A \u00ebsht\u00eb Firefox i preksh\u00ebm nga kjo problematik \u00ebsht\u00eb ende e paqart\u00eb, pasi informacioni mbi se si dob\u00ebsia ndikon n\u00eb produkte konkrete ende nuk \u00ebsht\u00eb publikuar. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"