CVE-2024-42328: JS - Crash on empty HTTP server response
When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curlwritecb when receiving data. If the server's response is an empty document, then wd->data in the code below will remain NULL and an attempt to read from it will result in a crash.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42328?
The severity of CVE-2024-42328 is classified as a medium-risk vulnerability.
How do I fix CVE-2024-42328?
To fix CVE-2024-42328, update your Zabbix installation to version 7.0.5 or later.
What systems are affected by CVE-2024-42328?
CVE-2024-42328 affects Zabbix versions from 7.0.0 to 7.0.4.
What are the potential consequences of CVE-2024-42328?
The potential consequences of CVE-2024-42328 include the risk of null pointer dereference leading to application crashes.
Is CVE-2024-42328 related to data handling in Zabbix?
Yes, CVE-2024-42328 is related to how Zabbix handles data pointers during HTTP server responses.