CVE-2024-42331

In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.

• CWE-416

• https://support.zabbix.com/browse/ZBX-25627Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/12/msg00005.html

Published

Nov 27, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42326There was discovered a use after free bug in browser.c in th…4.4
• CVE-2024-42327A non-admin user account on the Zabbix frontend with the def…9.9
• CVE-2024-42328When the webdriver for the Browser object downloads data fro…5.5
• CVE-2024-42329The webdriver for the Browser object expects an error object…3.3
• CVE-2024-4233Missing Authorization vulnerability in Tyche Softwares Print…4.3
• CVE-2024-42330The HttpRequest object allows to get the HTTP headers from t…9.1
• CVE-2024-42332The researcher is showing that due to the way the SNMP trap …3.7
• CVE-2024-42333The researcher is showing that it is possible to leak a smal…2.7
• CVE-2024-42334Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-423357Twenty - CWE-79: Improper Neutralization of Input During We…5.4
• CVE-2024-42336Servision - CWE-287: Improper Authentication9.8
• CVE-2024-42337CyberArk - CWE-200: Exposure of Sensitive Information to an…6.5