{"id":111788,"date":"2023-11-27T15:10:15","date_gmt":"2023-11-27T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos"},"modified":"2023-11-27T15:10:15","modified_gmt":"2023-11-27T13:10:15","slug":"uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","title":{"rendered":"S\u00e5rbarheter i Perl, ownCloud, GStreamer och Zephyr RTOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Flera nyligen uppt\u00e4ckta s\u00e5rbarheter:  <\/p>\n<ul>\n<li class=\"l\"> I den korrigerande versionen av Perl 5.38.1 har en s\u00e5rbarhet (CVE-2023-47038) \u00e5tg\u00e4rdats, som kan leda till skrivning av en byte utanf\u00f6r det allokerade minnet n\u00e4r man hanterar kompilerade regulj\u00e4ra uttryck med ett felaktigt omdefinierat internt Unicode-egenskap med ett namn som b\u00f6rjar med &#171;utf8::perl&#187;. Problemet uppst\u00e5r fr\u00e5n och med grenen Perl 5.30.\n<p>Dessutom har en plattformsspecifik s\u00e5rbarhet (CVE-2023-47039) \u00e5tg\u00e4rdats i Perl 5.38.1, vilket g\u00f6r att egen kod kan k\u00f6ras n\u00e4r skript k\u00f6rs, om det finns m\u00f6jlighet att placera en fil cmd.exe i den aktuella katalogen (p\u00e5 grund av avsaknad av rensning av s\u00f6kv\u00e4gar f\u00f6r att hitta k\u00f6rbara filer, f\u00f6rs\u00f6ker Perl f\u00f6rst k\u00f6ra cmd.exe i den aktuella katalogen). Till exempel kan en angripare placera sin cmd.exe i katalogen C:&#092;ProgramData och \u00f6ka sina privilegier om en administrat\u00f6r k\u00f6r ett Perl-skript fr\u00e5n denna katalog.    <\/p>\n<li class=\"l\"> I molnplattformen ownCloud, som separerades fr\u00e5n projektet Nextcloud 2016, har en s\u00e5rbarhet (CVE-2023-49103) uppt\u00e4ckts som p\u00e5verkar applikationen graphapi och som m\u00f6jligg\u00f6r att inneh\u00e5llet i milj\u00f6variabler kan fastst\u00e4llas, vilka kan inneh\u00e5lla administrat\u00f6rens l\u00f6senord, licensnyckel och inloggningsuppgifter f\u00f6r e-post. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/dts-shicago\/\"   title=\"servern\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2915\">servern<\/a>Problemet orsakas av anv\u00e4ndning av ett tredjepartsbibliotek i graphapi, som bland annat tillhandah\u00e5ller en handler f\u00f6r GetPhpInfo.php, som anropar funktionen phpinfo(), vars output inneh\u00e5ller milj\u00f6variabler.\n<li class=\"l\"> I det multimedia-ramverk som GStreamer har tv\u00e5 s\u00e5rbarheter uppt\u00e4ckts: CVE-2023-44446 \u2014 anv\u00e4ndning av minne efter att det har frigjorts (Use-After-Free) i koden f\u00f6r analys av MXF-filer; CVE-2023-44429 \u2014 buffer\u00f6verskridning i koden f\u00f6r analys av AV1-formatet. Det f\u00f6rsta problemet orsakas av avsaknad av kontroll av objektet innan operationer utf\u00f6rs p\u00e5 det, medan det andra beror p\u00e5 bristen p\u00e5 storlekskontroll av data innan kopiering till en fast buffer. S\u00e5rbarheterna kan leda till att angriparkod exekveras n\u00e4r man f\u00f6rs\u00f6ker bearbeta noggrant utformade MXF-filer och multimedia-data i AV1-format. Det noteras att attackvektorerna beror p\u00e5 implementeringen av den angripna applikationen. Problemen har tilldelats en riskniv\u00e5 p\u00e5 8,8 av 10. S\u00e5rbarheterna har \u00e5tg\u00e4rdats i versionen GStreamer 1.22.7.\n<li class=\"l\"> I operativsystemet Zephyr RTOS har 25 s\u00e5rbarheter identifierats, varav de flesta potentiellt kan leda till exekvering av angriparens kod. S\u00e5rbarheterna orsakas av buffert\u00f6verskridningar i WiFi-shell, Bluetooth-stacken, IPM-drivrutinen, USB-stacken, IEEE 802.15.4-drivrutinen, Mgmt-subsystemet, filsystemet, eS-WiFi-drivrutinen och CANbus-subsystemet. De flesta s\u00e5rbarheterna \u00e5tg\u00e4rdades i version Zephyr 3.5.0, men ett problem (CVE-2023-4261) f\u00f6rblir ofixat (detaljer om denna s\u00e5rbarhet publiceras inte f\u00f6rr\u00e4n en fix finns tillg\u00e4nglig).    <\/ul>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60185\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Unicode-\u0441\u0432\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c, \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u043c\u0441\u044f \u043d\u0430 &#171;utf8::perl&#187;. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 Perl 5.30. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u0430\u044f \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111788","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-11-27T13:10:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheter i Perl, ownCloud, GStreamer och Zephyr RTOS | ProHoster","description":"Flera nyligen uppt\u00e4ckta s\u00e5rbarheter: I den korrigerande versionen av Perl 5.38.1 har en s\u00e5rbarhet (CVE-2023-47038) \u00e5tg\u00e4rdats, som kan leda till att ett byte skrivs utanf\u00f6r den allokerade bufferten.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Perl, ownCloud, GStreamer \u0438 Zephyr RTOS | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Perl 5.38.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-47038), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0430\u0439\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-perl-owncloud-gstreamer-i-zephyr-rtos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-27T13:10:15+00:00","article:modified_time":"2023-11-27T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111788","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:03","updated":"2026-02-09 21:42:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/111788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=111788"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/111788\/revisions"}],"predecessor-version":[{"id":160195,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/111788\/revisions\/160195"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=111788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=111788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=111788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}