{"id":123408,"date":"2025-04-04T15:05:07","date_gmt":"2025-04-04T13:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-xz-utils-5-8-1-s-ustraneniem-uyazvimosti"},"modified":"2025-04-04T15:05:07","modified_gmt":"2025-04-04T13:05:07","slug":"obnovlenie-xz-utils-5-8-1-s-ustraneniem-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/obnovlenie-xz-utils-5-8-1-s-ustraneniem-uyazvimosti","title":{"rendered":"P\u00ebrdit\u00ebsimi i XZ Utils 5.8.1 me korrigjimin e cenueshm\u00ebris\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar versioni XZ Utils 5.8.1, i cili p\u00ebrfshin bibliotek\u00ebn liblzma dhe mjetet p\u00ebr pun\u00eb me t\u00eb dh\u00ebna t\u00eb kompresuara n\u00eb formatin «.xz». XZ Utils 5.8.1 u b\u00eb versioni i par\u00eb i r\u00ebnd\u00ebsish\u00ebm pas incidentit me zbulimin e backdoor-it q\u00eb mund\u00ebsonte hyrjen p\u00ebrmes sshd. Jav\u00ebn e kaluar n\u00eb Git u krijua etiketa 5.8.0, por publikimi nuk u njoftua zyrtarisht p\u00ebr shkak t\u00eb problemeve me performanc\u00ebn dhe p\u00ebrputhshm\u00ebrin\u00eb me versionet e vjetra t\u00eb GNU make, t\u00eb zbuluara pas publikimit t\u00eb etiket\u00ebs. <\/p>\n
N\u00eb p\u00ebrdit\u00ebsimin XZ Utils 5.8.1 \u00ebsht\u00eb korrigjuar cenueshm\u00ebria (CVE-2025-31115), e cila shkakton nd\u00ebrprerje kritike gjat\u00eb p\u00ebrpjekjes p\u00ebr t\u00eb dekompresuar arkiva t\u00eb p\u00ebrgatitura posa\u00e7\u00ebrisht. Cenueshm\u00ebria shkaktohet nga qasja n\u00eb nj\u00eb zon\u00eb memorieje tashm\u00eb t\u00eb liruar (use after free). Sulmuesi mund t\u00eb arrij\u00eb t\u00eb shkruaj\u00eb vler\u00ebn e vet n\u00eb nj\u00eb adres\u00eb t\u00eb llogaritur si «tregues null + zhvendosje». Problemi konsiderohet si nj\u00eb gabim i paq\u00ebllimsh\u00ebm, pasi ndryshimi q\u00eb e shkaktoi ishte futur n\u00eb kod shum\u00eb koh\u00eb para se zhvilluesi Jia Tan t'i bashkohej projektit, veprimtaria e t\u00eb cilit \u00e7oi n\u00eb futjen e backdoor-it. <\/p>\n
Problemi shfaqet duke filluar nga versioni XZ Utils 5.3.3alpha gjat\u00eb dekodimit n\u00eb regjim shum\u00ebfij\u00ebsh (dekoduesi nj\u00ebfij\u00ebsh nuk preket nga ky problem). P\u00ebrve\u00e7 mjeteve standarde t\u00eb paket\u00ebs xz, cenueshm\u00ebria shfaqet edhe n\u00eb programe t\u00eb pal\u00ebve t\u00eb treta q\u00eb p\u00ebrdorin funksionin lzma_stream_decoder_mt nga biblioteka liblzma. Cenueshm\u00ebria \u00ebsht\u00eb korrigjuar n\u00eb versionin XZ Utils 5.8.1 dhe gjithashtu \u00ebsht\u00eb bartur n\u00eb deg\u00ebt stabile 5.4 dhe 5.6. Mund t\u00eb ndiqni shfaqjen e p\u00ebrdit\u00ebsimeve n\u00eb shp\u00ebrndarje n\u00eb faqet vijuese: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. Si zgjidhje e p\u00ebrkohshme mbrojt\u00ebse, mund t\u00eb \u00e7aktivizohet dekodimi shum\u00ebfij\u00ebsh i skedar\u00ebve duke p\u00ebrdorur gjat\u00eb nisjes s\u00eb xz opsionet «—decompress —threads=1» ose duke p\u00ebrdorur mjetin xzdec. <\/p>\n
Nga ndryshimet funksionale n\u00eb deg\u00ebn XZ Utils 5.8 mund t\u00eb ve\u00e7ohen: <\/p>\n
\n
N\u00eb dekoduesin LZMA\/LZMA2 \u00ebsht\u00eb shtuar mund\u00ebsia e p\u00ebrdorimit t\u00eb instruksioneve SSE2 n\u00eb vend t\u00eb funksionit memcpy() n\u00eb sistemet x86 32-bit dhe 64-bit. Ky ndryshim ka mund\u00ebsuar uljen e koh\u00ebs s\u00eb dekodimit deri n\u00eb 5% kur nd\u00ebrtohet me Glibc, dhe deri n\u00eb 15% kur nd\u00ebrtohet me musl gjat\u00eb dekompresimit t\u00eb skedar\u00ebve me nivel shum\u00eb t\u00eb lart\u00eb kompresimi.\n
N\u00eb liblzma \u00ebsht\u00eb rritur shpejt\u00ebsia e kodimit n\u00eb sistemet 64-bit PowerPC dhe RISC-V.\n
N\u00eb lzma\/bcj.h \u00ebsht\u00eb shtuar API i nivelit t\u00eb ul\u00ebt i filtrave BCJ (Branch\/Call\/Jump) p\u00ebr sistemet RISC-V, ARM64 dhe x86.\n
\u00cbsht\u00eb rishkruar kodi p\u00ebr llogaritjen e CLMUL CRC p\u00ebr sistemet x86, x86-64 dhe E2K.\n
N\u00eb platformat me procesor\u00eb LoongArch jan\u00eb aktivizuar udh\u00ebzime p\u00ebr p\u00ebrshpejtimin e llogaritjes s\u00eb shumave kontrolluese CRC32.\n
N\u00eb mjetin «xz» \u00ebsht\u00eb siguruar thirrja e funksionit fsync() p\u00ebr t\u00eb zbrazur cache-in e skedar\u00ebve p\u00ebr skedarin e rezultatit para fshirjes s\u00eb skedarit burimor. P\u00ebr \u00e7aktivizimin e sinkronizimit para fshirjes \u00ebsht\u00eb shtuar opsioni «—no-sync».\n
N\u00eb mjetet xz, xzdec dhe lzmainfo, gjat\u00eb shfaqjes s\u00eb informacionit n\u00eb ekran, karakteret e paprintueshme z\u00ebvend\u00ebsohen me nj\u00eb pik\u00ebpyetje.\n
N\u00eb xz dhe xzdec, n\u00eb platform\u00ebn Linux, \u00ebsht\u00eb shtuar mb\u00ebshtetja p\u00ebr versionet 5 dhe 6 t\u00eb mekanizmit Landlock p\u00ebr izolimin e procesit.\n
\u00cbsht\u00eb shtuar skripti build-aux\/license-check.sh p\u00ebr kontrollin e licencave.\n
Skriptet lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep dhe lzfgrep, t\u00eb implementuara si shtresa shtes\u00eb mbi mjetin xz, jan\u00eb shpallur t\u00eb vjetruara. <\/ul>\n