CVE-2023-32722 — Classic Buffer Overflow in Zabbix

CWE-120 — Classic Buffer OverflowCWE-787 — Out-of-bounds Write4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.4%
top 41.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ZabbixDebian Zabbix
Timeline
PublishedOct 12

Description

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/zabbix< zabbix 1:5.0.44+dfsg-1+deb11u1 (bullseye)
▶Debianzabbix/zabbix< 1:5.0.44+dfsg-1+deb11u1+2
▶CVEListV5zabbix/zabbix7.0.0alpha1 — 7.0.0alpha3
▶NVDzabbix/zabbix6.0.0 — 6.0.20+2

🔴Vulnerability Details

2
GHSA
GHSA-g47w-cvcq-qh23: The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open↗2023-10-12
▶
OSV
CVE-2023-32722: The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open↗2023-10-12
▶

📋Vendor Advisories

1
Debian
CVE-2023-32722: zabbix - The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsi...↗2023
▶