CVE-2024-42331

In the src/libs/zbxembed/browser.c file, the esbrowserctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browserpusherror method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.

References

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type: GIT
Repo: https://github.com/zabbix/zabbix
Events: Introduced

49955f1fb5c9168a8a24b053f7ade6b3d903143c

Fixed

f383737f1083e25756c6afaaa8abff05ad11eb50

Affected versions

7.*

7.0.0

7.0.1

7.0.1rc1

7.0.1rc2

7.0.2

7.0.2rc1

7.0.2rc2

7.0.3

7.0.3rc1

7.0.4rc1

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/zabbix/zabbix/commit/f383737f1083e25756c6afaaa8abff05ad11eb50",
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2024-42331-efef764d",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        },
        "digest": {
            "line_hashes": [
                "158703392381671019955663987886552441761",
                "260539109617570610531885982419177346223",
                "24620959945945567121836211561936761519",
                "167792423538235293008428595269249306508",
                "192204268449565753401476537568276663620",
                "222572340168714685842508309588394178632"
            ],
            "threshold": 0.9
        },
        "deprecated": false
    }
]