Security update for zabbix SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:1604-1 Final 1 1 2020-10-04T04:22:54Z current 2020-10-04T04:22:54Z 2020-10-04T04:22:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for zabbix This update for zabbix fixes the following issues: Updated to version 3.0.31. + CVE-2020-15803: Fixed an XSS in the URL Widget (boo#1174253). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-1604 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4C6KYLGA3MCY6Q5OM7ZL6563XFHY2RTB/ E-Mail link for openSUSE-SU-2020:1604-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1174253 SUSE Bug 1174253 https://www.suse.com/security/cve/CVE-2020-11800/ SUSE CVE CVE-2020-11800 page https://www.suse.com/security/cve/CVE-2020-15803/ SUSE CVE CVE-2020-15803 page SUSE Package Hub 15 SP1 SUSE Package Hub 15 SP2 openSUSE Leap 15.1 openSUSE Leap 15.2 zabbix-agent-3.0.31-bp152.2.3.1 zabbix-bash-completion-3.0.31-bp152.2.3.1 zabbix-java-gateway-3.0.31-bp152.2.3.1 zabbix-phpfrontend-3.0.31-bp152.2.3.1 zabbix-proxy-3.0.31-bp152.2.3.1 zabbix-proxy-mysql-3.0.31-bp152.2.3.1 zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 zabbix-server-3.0.31-bp152.2.3.1 zabbix-server-mysql-3.0.31-bp152.2.3.1 zabbix-server-postgresql-3.0.31-bp152.2.3.1 zabbix-server-sqlite-3.0.31-bp152.2.3.1 zabbix-agent-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-bash-completion-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-java-gateway-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-phpfrontend-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-proxy-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-proxy-mysql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-server-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-server-mysql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-server-postgresql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-server-sqlite-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP1 zabbix-agent-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-bash-completion-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-java-gateway-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-phpfrontend-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-proxy-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-proxy-mysql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-server-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-server-mysql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-server-postgresql-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-server-sqlite-3.0.31-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 zabbix-agent-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-bash-completion-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-java-gateway-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-phpfrontend-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-proxy-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-proxy-mysql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-server-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-server-mysql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-server-postgresql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-server-sqlite-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.1 zabbix-agent-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-bash-completion-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-java-gateway-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-phpfrontend-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-proxy-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-proxy-mysql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-server-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-server-mysql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-server-postgresql-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 zabbix-server-sqlite-3.0.31-bp152.2.3.1 as a component of openSUSE Leap 15.2 Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. CVE-2020-11800 SUSE Package Hub 15 SP1:zabbix-agent-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-bash-completion-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-java-gateway-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-phpfrontend-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-sqlite-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-agent-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-bash-completion-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-java-gateway-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-phpfrontend-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-agent-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-bash-completion-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-java-gateway-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-phpfrontend-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-agent-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-bash-completion-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-java-gateway-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-phpfrontend-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-sqlite-3.0.31-bp152.2.3.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4C6KYLGA3MCY6Q5OM7ZL6563XFHY2RTB/ https://www.suse.com/security/cve/CVE-2020-11800.html CVE-2020-11800 https://bugzilla.suse.com/1177467 SUSE Bug 1177467 Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget. CVE-2020-15803 SUSE Package Hub 15 SP1:zabbix-agent-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-bash-completion-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-java-gateway-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-phpfrontend-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP1:zabbix-server-sqlite-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-agent-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-bash-completion-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-java-gateway-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-phpfrontend-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-mysql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-postgresql-3.0.31-bp152.2.3.1 SUSE Package Hub 15 SP2:zabbix-server-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-agent-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-bash-completion-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-java-gateway-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-phpfrontend-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.1:zabbix-server-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-agent-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-bash-completion-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-java-gateway-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-phpfrontend-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-mysql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-postgresql-3.0.31-bp152.2.3.1 openSUSE Leap 15.2:zabbix-server-sqlite-3.0.31-bp152.2.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4C6KYLGA3MCY6Q5OM7ZL6563XFHY2RTB/ https://www.suse.com/security/cve/CVE-2020-15803.html CVE-2020-15803 https://bugzilla.suse.com/1174253 SUSE Bug 1174253