Use after free in browser_push_error (CVE-2024-42331)

XMLWordPrintable

    • Type: Defect (Security)
    • Resolution: Fixed
    • Priority: Trivial
    • 7.0.4rc1
    • Affects Version/s: None
    • Component/s: Server (S)
    • None

      In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.

            Assignee:
            Zabbix Support Team
            Reporter:
            Vjaceslavs Bogdanovs
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: