This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-10134 →

DEBIAN-CVE-2016-10134

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids...

Original description

The description as published by the source.

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 zabbix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.4+dfsg-1"}]}]

Debian:13 zabbix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.4+dfsg-1"}]}]

Debian:14 zabbix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.4+dfsg-1"}]}]

References

advisory security-tracker.debian.org