ALT-PU-2026-4091-1

Обновление пакета zoneminder в ветке sisyphus_e2k

Версия1.38.1-alt3
Задание#0
Опубликовано2026-03-04
Макс. серьёзностьHIGH
Серьёзность:

Закрытые проблемы (1)

CVE-2026-27470
HIGH8.8

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.

Опубликовано: 2026-02-21Изменено: 2026-02-24
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Закрытые ошибки (4)

После обновления до новой версии не грузит стрим с камеры