This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-10140 →

DEBIAN-CVE-2016-10140

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29,...

Original description

The description as published by the source.

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

Debian:13 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

Debian:14 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

References

advisory security-tracker.debian.org