CVE-2016-10134
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0 ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Ubuntu (mittel).
Beschreibung
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | zabbix | 3.0.4-r0 |
| alpine 3.5 | zabbix | 3.0.4-r0 |
| debian 11 | zabbix | 1:3.0.4+dfsg-1 |
| debian 12 | zabbix | 1:3.0.4+dfsg-1 |
| debian 13 | zabbix | 1:3.0.4+dfsg-1 |
| debian 14 | zabbix | 1:3.0.4+dfsg-1 |
| debian 8 | zabbix | 1:2.2.7+dfsg-2+deb8u2 |
| echo | zabbix | 1:3.0.4+dfsg-1 |
| ubuntu 14.04-ESM | zabbix | 1:2.2.2+dfsg-1ubuntu1+esm1 |
Referenzen
- http://www.debian.org/security/2017/dsa-3802
- http://www.openwall.com/lists/oss-security/2017/01/12/4
- http://www.openwall.com/lists/oss-security/2017/01/13/4
- http://www.securityfocus.com/bid/95423
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936
- https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html
- https://support.zabbix.com/browse/ZBX-11023
- https://ubuntu.com/security/notices/USN-4767-1