ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืื™ื ื˜ืขืจื ืขื˜ ื ื™ื™ึทืขืก > ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ืคึฟืึทืจ Java SE, MySQL, VirtualBox ืื•ืŸ ืื ื“ืขืจืข ืึธืจืึทืงืœืข ืคึผืจืึธื“ื•ืงื˜ืŸ ืžื™ื˜ ืคืึทืจืคืขืกื˜ื™ืงื˜ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื–

ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ืคึฟืึทืจ Java SE, MySQL, VirtualBox ืื•ืŸ ืื ื“ืขืจืข ืึธืจืึทืงืœืข ืคึผืจืึธื“ื•ืงื˜ืŸ ืžื™ื˜ ืคืึทืจืคืขืกื˜ื™ืงื˜ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื–

ืึธืจืึทืงืœืข ืคึฟื™ืจืžืข ืืจื•ื™ืก ืกืงืขื“ื–ืฉื•ืœื“ ืžืขืœื“ื•ื ื’ ืคื•ืŸ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ืฆื• ื–ื™ื™ืขืจ ืคึผืจืึธื“ื•ืงื˜ืŸ (ืงืจื™ื˜ื™ืฉ ืคึผืึทื˜ืฉ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ), ืึทื™ืžืขื“ ืฆื• ืขืœื™ืžื™ื ื™ืจืŸ ืงืจื™ื˜ื™ืฉ ืคึผืจืึธื‘ืœืขืžืก ืื•ืŸ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื–. ืื™ืŸ ื“ื™ ื™ืื ื•ืืจ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ, ื“ื™ ืกื•ืžืข ื™ืœื™ืžืึทื ื™ื™ื˜ืึทื“ 397 ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื–.

ื™ืฉื•ื– Java SE 14.0.1, 11.0.7 ืื•ืŸ 8u251 ื™ืœื™ืžืึทื ื™ื™ื˜ืึทื“ 15 ื–ื™ื›ืขืจื”ื™ื™ึทื˜ ื™ืฉื•ื–. ืึทืœืข ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ืงืขื ืขืŸ ื–ื™ื™ืŸ ืขืงืกืคึผืœื•ื™ื˜ืึทื“ ืจื™ืžืึธื•ื˜ืœื™ ืึธืŸ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ. ื“ื™ ื”ืขื›ืกื˜ืŸ ืฉื˜ืจืขื ื’ืงื™ื™ึทื˜ ืžื“ืจื’ื” ืื™ื– 8.3, ื•ื•ืึธืก ืื™ื– ืึทืกื™ื™ื ื“ ืฆื• ืคึผืจืึธื‘ืœืขืžืก ืื™ืŸ ืœื™ื™ื‘ืจืขืจื™ื– (CVE-2020-2803, CVE-2020-2805). ืฆื•ื•ื™ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– (ืื™ืŸ libxslt ืื•ืŸ JSSE) ื”ืึธื‘ืŸ ืฉื˜ืจืขื ื’ืงื™ื™ื˜ ืœืขื•ื•ืขืœืก ืคื•ืŸ 8.1 ืื•ืŸ 7.5.

ืื™ืŸ ืึทื“ื™ืฉืึทืŸ ืฆื• ื™ืฉื•ื– ืื™ืŸ Java SE, ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ื–ืขื ืขืŸ ื’ืขืžืื›ื˜ ืขืคื ื˜ืœืขืš ืื™ืŸ ืื ื“ืขืจืข ืึธืจืึทืงืœืข ืคึผืจืึธื“ื•ืงื˜ืŸ, ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜:

  • 35 ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ืื™ืŸ MySQL ืกืขืจื•ื•ืขืจ ืื•ืŸ
    2 ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ืื™ืŸ ื“ื™ ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ื™ MySQL ืงืœื™ืขื ื˜ (C API). ื“ื™ ื”ืขื›ืกื˜ืŸ ืฉื˜ืจืขื ื’ืงื™ื™ึทื˜ ืžื“ืจื’ื” ืคื•ืŸ 9.8 ืื™ื– ืึทืกื™ื™ื ื“ ืฆื• ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ CVE-2019-5482, ื•ื•ืึธืก ืื™ื– ืืจื•ื™ืก ื•ื•ืขืŸ ืงืึทืžืคึผื™ื™ืœื“ ืžื™ื˜ cURL ืฉื˜ื™ืฆืŸ. ื™ืฉื•ื– ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ืจื™ืœื™ืกื™ื– MySQL Community Server 8.0.20, 5.7.30 ืื•ืŸ 5.6.49.

  • 19 ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื–, ืคื•ืŸ ื•ื•ืึธืก 7 ืคึผืจืึธื‘ืœืขืžืก ื”ืึธื‘ืŸ ืึท ืงืจื™ื˜ื™ืฉ ืžื“ืจื’ื” ืคื•ืŸ ื’ืขืคืึทืจ (CVSS ื’ืจืขืกืขืจ ื•ื•ื™ 8). ื“ืึธืก ื›ื•ืœืœ ืคื™ืงืกื™ืจ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ื’ืขื ื™ืฆื˜ ืื™ืŸ ืื ืคืืœืŸ ื“ืขืžืึทื ืกื˜ืจื™ื™ื˜ื™ื“ ืื™ืŸ ื“ื™ ืคืึทืจืžืขืกื˜ Pwn2Own 2020 ืื•ืŸ ืึทืœืึทื•ื™ื ื’, ื“ื•ืจืš ืžืึทื ื™ืคึผื™ืึทืœื™ื™ืฉืึทื ื– ืื•ื™ืฃ ื“ื™ ื–ื™ื™ึทื˜ ืคื•ืŸ ื“ื™ ื’ืึทืกื˜ ืกื™ืกื˜ืขื, ืฆื• ื‘ืึทืงื•ืžืขืŸ ืึทืงืกืขืก ืฆื• ื“ืขืจ ื‘ืึทืœืขื‘ืึธืก ืกื™ืกื˜ืขื ืื•ืŸ ื•ื™ืกืคื™ืจืŸ ืงืึธื“ ืžื™ื˜ ื”ื™ืคึผืขืจื•ื•ื™ื™ื–ืขืจ ืจืขื›ื˜. ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ื–ืขื ืขืŸ ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ื•ื•ื™ืจื˜ื•ืึทืœื‘ืึธืงืก 6.1.6, 6.0.20 ืื•ืŸ 5.2.40.
  • 6 ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ืื™ืŸ ืกืึธืœืึทืจื™ืก. ืžืึทืงืกื™ืžื•ื ื’ืขืคืึทืจ ืžื“ืจื’ื” 8.8 - ืœืึธื•ืงืึทืœื™ ืึทืคึผืขืจื™ื™ื˜ืึทื“ ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ืŸ ื“ืขืจ ืงืึธืžืžืึธืŸ ื“ืขืกืงื˜ืึธืคึผ ืขื ื•ื•ื™ืจืึธื ืžืขื ื˜, ืึทืœืึทื•ื™ื ื’ ืึท ืึทื ืคึผืจื™ื•ื•ื™ืœื™ื“ื–ืฉื“ ื‘ืึทื ื™ืฆืขืจ ืฆื• ื•ื™ืกืคื™ืจืŸ ืงืึธื“ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื–. ื™ืฉื•ื– ื–ืขื ืขืŸ ืื•ื™ืš ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ื“ื™ ืงืขืจืŸ ืžืึธื“ื•ืœืข ื™ืžืคึผืœืึทืžืขื ื™ื ื’ ื“ื™ SMB ืคึผืจืึธื˜ืึธืงืึธืœ, ืื™ืŸ Whodo ืื•ืŸ ืื™ืŸ ื“ื™ svcbundle SMF ื‘ืึทืคึฟืขืœ. ื™ืฉื•ื– ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ื ืขื›ื˜ืŸ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ ืกืึธืœืึทืจื™ืก 11.4 SRU 20.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’