bugtraq - [SECURITY] [DSA 3937-1] zabbix security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 12 Aug 2017 02:23:57 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3937-1] zabbix security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3937-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
August 12, 2017                       https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : zabbix
CVE ID         : CVE-2017-2824 CVE-2017-2825

Lilith Wyatt discovered two vulnerabilities in the Zabbix network
monitoring system which may result in execution of arbitrary code or
database writes by malicious proxies.

For the oldstable distribution (jessie), these problems have been fixed
in version 1:2.2.7+dfsg-2+deb8u3.

For the stable distribution (stretch), these problems have been fixed
prior to the initial release.

We recommend that you upgrade your zabbix packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlmOSigACgkQEMKTtsN8
TjYRuxAAis2sOiulhjVT4cAh/S+wbzKJWX/hp3cItQbMlkdY/dxjfhBlSbNvogVg
C7Y3gC2qLO5zWmP6w/OKT3QadmK4nMeuZEWMdgBwHijWXwB5dgb3yuEeeaMTxBRl
cEfcz/lfswQQdrikD+boWDdur/wacjjM7OmVCjjGYDH9Y5ncs1SzV58g7vTYxCAW
VIywGs/SWIv/jBNrQ7CPa2Jkyqz+3Hkojqp0VdUmHSYXPMf1MpNE3/BYka0AC//f
cXq5t/eXlKUSzJqQxEadQhjPLuRqeJ3Zdd7RDNEpi4+TWAUpUg7f0IPi1FYCXUdK
OPMhj/CMsQaNeu9VNsdNuHjsowo4lBEc3KWZ1N8SrfnUuJ0rF0ojeXSqmgbG2IcC
PKDfKZxD5QU3f9kujIQ/lcxeE9SBrlj7zURwquMf3bTFKtQP+JckxKJ8uwqkP1O1
EF7L1fsQGb+EWL78Dx57EE78mhJqk1YZWdwbLiOhTuuAF9e7NoZlOcIJOWHwIHHc
2B05PobZbboIFp3LsrXeXK67Z1eUl+olhMoVBiQ7h+d1HV9XF0rtHleE5npCVVem
zk6AuzTrQb+HXLM8/vMvL47SuxP25UyoCXltGhOH1HTVqVQw7eZw9EEUoyQp4hll
X6akX0vqWHOM2p5RU87qwCciRVbBDfpBxmh08Fw6/68vwhS8f/M=
=QSuN
-----END PGP SIGNATURE-----