CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

zabbix: patch CVE-2025-49643

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49643

The actual patch was identified by checking the file that was modified
in the tag 6.0.42, and also by looking at the Jira item referenced by it:
the patch references DEV-4466, the same ID that is referenced in the
Jira ticket[1] referenced by the NVD report (look in the "All Activity" tab).

[1]: https://support.zabbix.com/browse/ZBX-27284

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Gyorgy Sarvari 2025-12-24 14:35:19 +01:00 committed by Anuj Mittal
parent b7180060eb
commit cf81094887
No known key found for this signature in database
GPG Key ID: 4340AEFE69F5085C
2 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
meta-oe/recipes-connectivity/zabbix/zabbix/CVE-2025-49643.patch Normal file
View File

@ -0,0 +1,38 @@
From 6677023e3d48faa83d011c0d9ec241c9e617ed78 Mon Sep 17 00:00:00 2001
From: Ginta Berzina <ginta.berzina@zabbix.com>
Date: Mon, 1 Sep 2025 14:10:12 +0300
Subject: [PATCH] ..F....... [DEV-4466] fixed resource usage for image resize
CVE: CVE-2025-49643
Upstream-Status: Backport [https://github.com/zabbix/zabbix/commit/aeada86d3c8231e1e173c6a7ac19ea60bf899b86]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
ui/imgstore.php | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/ui/imgstore.php b/ui/imgstore.php
index 125b3c3..04663e8 100644
--- a/ui/imgstore.php
+++ b/ui/imgstore.php
@@ -34,8 +34,8 @@ $fields = [
'css' => [T_ZBX_INT, O_OPT, P_SYS, null, null],
'imageid' => [T_ZBX_STR, O_OPT, P_SYS, null, null],
'iconid' => [T_ZBX_INT, O_OPT, P_SYS, DB_ID, null],
- 'width' => [T_ZBX_INT, O_OPT, P_SYS, BETWEEN(1, 2000), null],
- 'height' => [T_ZBX_INT, O_OPT, P_SYS, BETWEEN(1, 2000), null],
+ 'width' => [T_ZBX_INT, O_OPT, P_SYS, BETWEEN(1, 200), null],
+ 'height' => [T_ZBX_INT, O_OPT, P_SYS, BETWEEN(1, 200), null],
'unavailable' => [T_ZBX_INT, O_OPT, null, IN([0, 1]), null]
];
check_fields($fields);
@@ -58,10 +58,6 @@ if (isset($_REQUEST['css'])) {
foreach ($images as $image) {
$image['image'] = base64_decode($image['image']);
$ico = imagecreatefromstring($image['image']);
-
- if ($resize) {
- $ico = imageThumb($ico, $width, $height);
- }
$w = imagesx($ico);
$h = imagesy($ico);

1
meta-oe/recipes-connectivity/zabbix/zabbix_6.2.9.bb
View File

@ -27,6 +27,7 @@ SRC_URI = "https://cdn.zabbix.com/zabbix/sources/oldstable/6.2/${BPN}-${PV}.tar.
file://0001-Fix-configure.ac.patch \
file://0001-initialize-msghdr-portably.patch \
file://zabbix-agent.service \
file://CVE-2025-49643.patch \
"
SRC_URI[sha256sum] = "a2325be57b8027bb340bb602c33f8092165dbce4da562301c03867101a21efa6"