Log in Start free

Vulnerability · Published Dec 18, 2023 · Assigned by Zabbix

CVE-2023-32726Possible buffer overread from reading DNS responses

Low 3.9

In plain English

A low-severity security flaw in Zabbix from Zabbix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.9Low
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zabbixno fix listedDEBIAN-CVE-2023-32726
Debian:13zabbix1:6.0.24+dfsg-1DEBIAN-CVE-2023-32726
Debian:14zabbix1:6.0.24+dfsg-1DEBIAN-CVE-2023-32726

Affected products (as reported)

VendorProductVersions
Zabbix Zabbix 5.0.0 – through 5.0.396.0.0 – through 6.0.236.4.0 – through 6.4.87.0.0alpha1 – through 7.0.0alpha7

Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References