N\u00eb bibliotek\u00ebn Libxml2, e zhvilluar nga projekti GNOME dhe e p\u00ebrdorur p\u00ebr analizimin e p\u00ebrmbajtjes n\u00eb formatin XML, jan\u00eb identifikuar 5 cenueshm\u00ebri, dy prej t\u00eb cilave potencialisht mund t\u00eb \u00e7ojn\u00eb n\u00eb ekzekutim kodi gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb jashtme t\u00eb p\u00ebrgatitura posa\u00e7\u00ebrisht. Biblioteka Libxml2 p\u00ebrdoret gjer\u00ebsisht n\u00eb projekte me kod t\u00eb hapur dhe, p\u00ebr shembull, p\u00ebrdoret si var\u00ebsi n\u00eb m\u00eb shum\u00eb se 800 paketa t\u00eb Ubuntu-s\u00eb. <\/p>\n
Cenueshm\u00ebria e par\u00eb (CVE-2025-6170) shkaktohet nga tejmbushja e buffer-it n\u00eb implementimin e shell-it interaktiv xmllint, i p\u00ebrdorur p\u00ebr analizimin e skedar\u00ebve XML. Tejmbushja ndodh gjat\u00eb p\u00ebrpunimit t\u00eb argumenteve shum\u00eb t\u00eb gjata t\u00eb komandave p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kontrollit t\u00eb duhur t\u00eb madh\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave hyr\u00ebse p\u00ebrpara kopjimit t\u00eb t\u00eb dh\u00ebnave nga funksioni strcpy(). P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb cenueshm\u00ebri, sulmuesi duhet t\u00eb ket\u00eb mund\u00ebsi t\u00eb ndikoj\u00eb te komandat q\u00eb i kalohen mjetit xmllint. Patch-i p\u00ebr korrigjimin e cenueshm\u00ebris\u00eb ende nuk \u00ebsht\u00eb i disponuesh\u00ebm. <\/p>\n
Cenueshm\u00ebria e dyt\u00eb (CVE-2025-6021) ndodhet n\u00eb implementimin e funksionit xmlBuildQName() dhe \u00e7on n\u00eb shkrimin e t\u00eb dh\u00ebnave jasht\u00eb buffer-it p\u00ebr shkak t\u00eb tejmbushjes s\u00eb numrave t\u00eb plot\u00eb gjat\u00eb llogaritjes s\u00eb madh\u00ebsis\u00eb s\u00eb buffer-it bazuar n\u00eb prefiksin dhe emrin lokal. P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb cenueshm\u00ebri, sulmuesi duhet t\u00eb arrij\u00eb t\u00eb fus\u00eb t\u00eb dh\u00ebnat e veta n\u00eb argumentet prefix dhe ncname q\u00eb i kalohen funksionit xmlBuildQName(). P\u00ebr eliminimin e cenueshm\u00ebris\u00eb \u00ebsht\u00eb p\u00ebrgatitur nj\u00eb patch. Korrigjimi \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb versionin libxml2 2.14.4. Gjendja e versionit t\u00eb ri t\u00eb paket\u00ebs ose p\u00ebrgatitja e korrigjimit n\u00eb shp\u00ebrndarje mund t\u00eb kontrollohet n\u00eb faqet n\u00eb vijim (n\u00ebse nj\u00eb faqe nuk \u00ebsht\u00eb e disponueshme, do t\u00eb thot\u00eb se zhvilluesit e shp\u00ebrndarjes ende nuk kan\u00eb nisur shqyrtimin e problemit): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo dhe Arch (1, 2). <\/p>\n
Tri problemet e tjera \u00e7ojn\u00eb n\u00eb nd\u00ebrprerje t\u00eb menj\u00ebhershme t\u00eb pun\u00ebs p\u00ebr shkak t\u00eb qasjes n\u00eb nj\u00eb zon\u00eb memorieje tashm\u00eb t\u00eb liruar n\u00eb funksionin xmlSchematronGetNode (CVE-2025-49794), dereferencimit t\u00eb nj\u00eb treguesi null n\u00eb funksionin xmlXPathCompiledEval (CVE-2025-49795) dhe p\u00ebrpunimit t\u00eb pasakt\u00eb t\u00eb tipeve (Type Confusion) n\u00eb funksionin xmlSchematronFormatReport (CVE-2025-49796). P\u00ebr zgjidhjen e k\u00ebtyre cenueshm\u00ebrive po shqyrtohet mund\u00ebsia e heqjes s\u00eb mb\u00ebshtetjes p\u00ebr gjuh\u00ebn e markup-it Schematron nga libxml2. <\/p>\n
Gjithashtu raportohet p\u00ebr pranin\u00eb e tre dob\u00ebsive t\u00eb pakorrigjuara n\u00eb bibliotek\u00ebn libxslt, e cila ka mbetur pa mir\u00ebmbajt\u00ebs. Informacioni p\u00ebr k\u00ebto probleme ende nuk \u00ebsht\u00eb b\u00ebr\u00eb publik dhe \u00ebsht\u00eb planifikuar t\u00eb publikohet m\u00eb 9 korrik, 13 korrik dhe 6 gusht. Dob\u00ebsi t\u00eb pakorrigjuara dhe ende jo t\u00eb publikuara publikisht v\u00ebrehen gjithashtu n\u00eb projektet e lidhura me GNOME: gvfs, libgxps, gdm, glib, GIMP dhe libsoup. <\/p>\n
P\u00ebrdit\u00ebsim: Mir\u00ebmbajt\u00ebsi i libxml2 ka njoftuar se, duke filluar nga tani, do t\u2019i trajtoj\u00eb dob\u00ebsit\u00eb si gabime t\u00eb zakonshme, pa u dh\u00ebn\u00eb p\u00ebrpar\u00ebsi m\u00eb t\u00eb lart\u00eb, duke i rregulluar kur t\u00eb ket\u00eb koh\u00eb t\u00eb lir\u00eb dhe duke zbuluar menj\u00ebher\u00eb informacionin p\u00ebr thelbin e dob\u00ebsis\u00eb pa vendosur embargo dhe pa dh\u00ebn\u00eb koh\u00eb p\u00ebr korrigjim n\u00eb produktet e pal\u00ebve t\u00eb treta. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"