N\u00eb bibliotek\u00ebn Libxml2, e zhvilluar nga projekti GNOME dhe e p\u00ebrdorur p\u00ebr analizimin e p\u00ebrmbajtjes n\u00eb formatin XML, jan\u00eb identifikuar 5 dob\u00ebsi, dy prej t\u00eb cilave potencialisht mund t\u00eb \u00e7ojn\u00eb n\u00eb ekzekutimin e kodit kur p\u00ebrpunohen t\u00eb dh\u00ebna t\u00eb jashtme t\u00eb strukturuara n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. Biblioteka Libxml2 \u00ebsht\u00eb e p\u00ebrhapur gjer\u00ebsisht n\u00eb projekte t\u00eb hapura dhe, p\u00ebr shembull, p\u00ebrdoret si var\u00ebsi n\u00eb m\u00eb shum\u00eb se 800 paket\u00eb t\u00eb Ubuntu. <\/p>\n
Dob\u00ebsia e par\u00eb (CVE-2025-6170) shkaktohet nga t\u00ebrheqja e tejskajshme n\u00eb implementimin e shell-it interaktiv xmllint, e cila p\u00ebrdoret p\u00ebr analizimin e skedar\u00ebve XML. T\u00ebrheqja ndodh gjat\u00eb p\u00ebrpunimit t\u00eb argumenteve shum\u00eb t\u00eb gjata t\u00eb komandave p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kontrollit t\u00eb sakt\u00eb t\u00eb madh\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave hyr\u00ebse para kopjimit t\u00eb t\u00eb dh\u00ebnave nga funksioni strcpy(). P\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsin\u00eb, nj\u00eb sulmues duhet t\u00eb ket\u00eb mund\u00ebsi t\u00eb ndikoj\u00eb n\u00eb komandat e d\u00ebrguara n\u00eb utilitarin xmllint. Patch p\u00ebr zgjidhjen e k\u00ebsaj dob\u00ebsie nuk \u00ebsht\u00eb akoma n\u00eb dispozicion. <\/p>\n
Dob\u00ebr, e dyta (CVE-2025-6021) ndodhet n\u00eb implementimin e funksionit xmlBuildQName() dhe \u00e7on n\u00eb shkrimin e t\u00eb dh\u00ebnave p\u00ebrtej tamponit si rezultat i mbivler\u00ebsimit t\u00eb numrave kur llogaritet madh\u00ebsia e tamponit n\u00eb baz\u00eb t\u00eb prefiksit dhe emrit lokal. P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb dob\u00ebsi, sulmuesi duhet t\u00eb arrij\u00eb q\u00eb t\u00eb vendos\u00eb t\u00eb dh\u00ebnat e tij n\u00eb argumentet prefix dhe ncname t\u00eb funksionit xmlBuildQName(). Nj\u00eb patch \u00ebsht\u00eb p\u00ebrgatitur p\u00ebr t\u00eb adresuar k\u00ebt\u00eb dob\u00ebsi. Korrigjimi \u00ebsht\u00eb inkorporuar n\u00eb l\u00ebshimin e libxml2 2.14.4. Mund t\u00eb verifikohet gjendja e versionit t\u00eb ri t\u00eb paket\u00ebs ose p\u00ebrgatitjes s\u00eb korrigjimit n\u00eb shp\u00ebrndarje t\u00eb ndryshme n\u00eb faqet e m\u00ebposhtme (n\u00ebse faqja nuk \u00ebsht\u00eb n\u00eb dispozicion, at\u00ebher\u00eb zhvilluesit e shp\u00ebrndarjes nuk kan\u00eb filluar ende shqyrtimin e problemit): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo dhe Arch (1, 2). <\/p>\n
Problemet e tjera tre shkaktojn\u00eb nj\u00eb nd\u00ebrprerje p\u00ebr shkak t\u00eb qasjes n\u00eb nj\u00eb zon\u00eb memorie q\u00eb \u00ebsht\u00eb \u00e7liruar tashm\u00eb n\u00eb funksionin xmlSchematronGetNode (CVE-2025-49794), dereferencimi i nj\u00eb treguesi null n\u00eb funksionin xmlXPathCompiledEval (CVE-2025-49795) dhe trajtimi i gabuar i tipeve (Confusion e Tipit) n\u00eb funksionin xmlSchematronFormatReport (CVE-2025-49796). P\u00ebr t\u00eb adresuar k\u00ebto dob\u00ebsi, po shqyrtohet mund\u00ebsia e heqjes s\u00eb mb\u00ebshtetjes p\u00ebr gjuh\u00ebn e sh\u00ebnjimit Schematron nga libxml2. <\/p>\n
P\u00ebr m\u00eb tep\u00ebr, v\u00ebrehet se ekzistojn\u00eb tre dob\u00ebsi t\u00eb paparagjykuara n\u00eb bibliotek\u00ebn libxslt, q\u00eb ka mbetur pa ndihm\u00ebs. Informacioni n\u00eb lidhje me k\u00ebto probleme ende nuk \u00ebsht\u00eb zbuluar dhe \u00ebsht\u00eb planifikuar t\u00eb publikohet m\u00eb 9 korrik, 13 korrik dhe 6 gusht. Dob\u00ebsi t\u00eb paparagjykuara dhe t\u00eb pabler\u00eb publikisht gjithashtu v\u00ebrehen n\u00eb projektet lidhur me GNOME si gvfs, libgxps, gdm, glib, GIMP dhe libsoup. <\/p>\n
Shtes\u00eb: Ndihm\u00ebsja e libxml2 njoftoi se nga tani do t\u00eb interpretoj\u00eb dob\u00ebsit\u00eb si gabime t\u00eb zakonshme, duke mos i b\u00ebr\u00eb ato m\u00eb prioritare, duke i rregulluar kur t\u00eb ket\u00eb koh\u00eb t\u00eb lir\u00eb dhe duke zbuluar menj\u00ebher\u00eb informacionin mbi natyr\u00ebn e dob\u00ebsis\u00eb pa vendosur embargo dhe duke ofruar koh\u00eb p\u00ebr eliminim n\u00eb produktet e pal\u00ebve t\u00eb treta. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"