Multiple vulnerabilities were discovered in Gentoo's ebuild for Zabbix which could lead to root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/zabbix | * | < 4.4.6 | >= 3.0.30:0/3.0, >= 4.0.18:0/4.0 |
Zabbix is software for monitoring applications, networks, and servers.
It was discovered that Gentoo’s Zabbix ebuild did not properly set permissions or placed the pid file in an unsafe directory.
A local attacker could escalate privileges.
There is no known workaround at this time.
All Zabbix 3.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-3.0.30:0/3.0"
All Zabbix 4.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-4.0.18:0/4.0"
All other Zabbix users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-4.4.6"
Multiple vulnerabilities have been found in Zabbix, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/zabbix | * | < 2.2.16 | >= 2.2.16 |
Zabbix is software for monitoring applications, networks, and servers.
Multiple vulnerabilities have been discovered in Zabbix. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time.
All Zabbix users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-2.2.16"
A vulnerability in Zabbix could allow remote attackers to execute arbitrary shell code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/zabbix | * | < 2.0.9-r1 | >= 2.0.9-r1 |
Zabbix is software for monitoring applications, networks, and servers.
If a flexible user parameter is configured in Zabbix agent, including a newline in the parameters will execute newline section as a separate command even if UnsafeUserParameters are disabled.
A remote attacker could possibly execute arbitrary shell code with the privileges of the process.
There is no known workaround at this time.
All Zabbix 2.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-2.2.0-r4"
All Zabbix 2.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-2.0.9-r1"
Multiple vulnerabilities have been found in Zabbix, possibly leading to SQL injection attacks, Denial of Service, or information disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/zabbix | * | < 2.0.9_rc1-r2 | >= 2.0.9_rc1-r2 |
Zabbix is software for monitoring applications, networks, and servers.
Multiple vulnerabilities have been discovered in Zabbix. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to execute arbitrary SQL statements, cause a Denial of Service condition, or obtain sensitive information.
There is no known workaround at this time.
All Zabbix users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/zabbix-2.0.9_rc1-r2"