CVE-2024-42331 Use after free in browser_push_error
A use-after-free vulnerability in Zabbix's browser error handling allows attackers to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42331?
CVE-2024-42331 is a low-severity use after free vulnerability in Zabbix Zabbix, published on 27 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.
Weakness: CWE-416
Which versions are affected by CVE-2024-42331?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2024-42331?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-42331 being exploited?
There is no known exploitation of CVE-2024-42331 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2024-42331, GHSA-xq5v-w2v7-hg7j, UBUNTU-CVE-2024-42331.