Vulnérabilités de zabbix · Page n° 5

Remove possibility to add html into Geomap attribution field

Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.

• Mettez à jour vers 6.0.18rc1
• Mettez à jour vers 6.4.2rc1

Denial of service caused by a bug in the JSON parser

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.

• Mettez à jour vers 6.0.15rc1
• Mettez à jour vers 6.2.9rc2
• Mettez à jour vers 6.4.1rc2

Unauthorized limited filesystem access from preprocessing

JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.

• Mettez à jour vers 5.0.32rc1
• Mettez à jour vers 6.2.8rc1

Limited control of resource utilization in JS preprocessing

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

• Mettez à jour vers 5.0.32rc1
• Mettez à jour vers 6.2.8rc1
• Mettez à jour vers 6.4.0rc2

CVE-2013-3628

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

CVE-2017-2824

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.