CVE-2024-42331: Use after free in browser_push_error
In the src/libs/zbxembed/browser.c file, the esbrowserctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browserpusherror method in the src/libs/zbxembed/browsererror.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42331?
CVE-2024-42331 is classified as a critical vulnerability due to the potential for use-after-free exploitation.
How do I fix CVE-2024-42331?
To fix CVE-2024-42331, upgrade Zabbix to version 7.0.5 or higher.
What systems are affected by CVE-2024-42331?
CVE-2024-42331 affects Zabbix versions from 7.0.0 to 7.0.4.
What is the impact of CVE-2024-42331?
The impact of CVE-2024-42331 can include remote code execution due to a use-after-free vulnerability.
Is CVE-2024-42331 exploitable remotely?
Yes, due to its nature, CVE-2024-42331 can be exploited remotely.