Slashdot Mirror
Severe Flaws Found In Libarchive Open Source Library (talosintel.com)
Reader itwbennett writes: Researchers from Cisco Systems' Talos group have found three memory corruption errors in the widely used open-source library libarchive that can result in arbitrary code execution and can be exploited by passing specially crafted files to applications that contain the vulnerable code. "The library is used by file and package managers included in many Linux and BSD systems, as well as by components and tools in OS X and Chrome OS," writes Lucian Constantin. "Developers can also include the library's code in their own projects, so it's hard to know how many other applications or firmware packages contain it." (Original blog post) So, while the libarchive maintainers have released patches for the flaws, it will likely take a long time for them to trickle down through all the affected projects.
Its just so funny. Most rust applications as of now only work because they use rust wrappers to native libraries. So even if you wrote your program in rust, if you used this crate, you'd have exactly the same problems as all those c/c++ writers: https://crates.io/crates/libar...
Basically, your post boils down to "I don't understand something, therefore it cannot possibly exist"
Now, I honestly can't tell if you're being serious or just trolling, but for your benefit, in short:
1. Shared libraries have extensive versioning information embedded into them, which is why you can hold a couple of versions of the same library. The real point of versioning is to signal ABI changes, and not marketing as you may assume.
2. If you upgrade a library, you don't crash an existing program due to ABI changes because of 1. versioning, and also because of copy on run semantics.
3. Versioning and dependencies have been a pretty much solved problem for many years now. In fact, we're spoilt for choice with ways to manage this.
4. You don't want to hold a single copy of a library that something you installed depends on, but you'd rather hold multiple copies of the every library for every single thing you've installed? I don't understand why you can't see that this is far worse.
So I'll leave you to your security nightmare, and when you get hacked and your bank account emptied, remember to tell your bank that you were warned but failed to take sensible precautions!