Out-of-bounds read in Zabbix - CVE-2024-42333

Vulnerability identifier: #VU101063

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-42333

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote usre to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in src/libs/zbxmedia/email.c. A remote user can trigger an out-of-bounds read error and read contents of memory on the system.

Zabbix
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Fedora
zabbix-agent-debuginfo
zabbix-agent
zabbix-debugsource
zabbix6.0
zabbix

Install updates from vendor's website.

Zabbix - addressed in versions 6.0.34 rc1, 6.4.19 rc1, 7.0.4 rc1
zabbix-agent-debuginfo - update to 4.0.12-4.32.1
zabbix-agent - update to 4.0.12-4.32.1
zabbix-debugsource - update to 4.0.12-4.32.1
zabbix6.0 - update to 6.0.36-1.el8
zabbix - addressed in versions 6.0.36-1.el9, 6.0.36-1.fc40

• https://support.zabbix.com/browse/ZBX-25629

• Multiple vulnerabilities in Zabbix
• Fedora 40 update for zabbix
• Fedora EPEL 9 update for zabbix
• Fedora EPEL 8 update for zabbix6.0
• SUSE update for zabbix