SUSE-SU-2026:0483-1: low: Security update for zabbix

[SLE-SECURITY-UPDATES]

# Security update for zabbix

Announcement ID: SUSE-SU-2026:0483-1  
Release Date: 2026-02-12T16:34:19Z  
Rating: low  
References:

  * bsc#1240676
  * bsc#1240678

  
Cross-References:

  * CVE-2024-36469
  * CVE-2024-42325

  
CVSS scores:

  * CVE-2024-36469 ( SUSE ):  2.3
    CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2024-36469 ( SUSE ):  3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
  * CVE-2024-36469 ( NVD ):  2.3
    CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-36469 ( NVD ):  3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
  * CVE-2024-42325 ( SUSE ):  2.1
    CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2024-42325 ( SUSE ):  3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  * CVE-2024-42325 ( NVD ):  2.1
    CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-42325 ( NVD ):  3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

  
Affected Products:

  * SUSE Linux Enterprise Server 12 SP5
  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
  * SUSE Linux Enterprise Server for SAP Applications 12 SP5

  
  
An update that solves two vulnerabilities can now be installed.

## Description:

This update for zabbix fixes the following issues:

  * CVE-2024-36469: Introduced clamping for mitigation of timing attacks.
    (bsc#1240676)
  * CVE-2024-42325: Restricted access to user fields using user.get API method
    for users of User and Admin type, and restricted access to alert entities
    using alert.get API method for users of User and Admin types. (bsc#1240678)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security  
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-483=1

## Package List:

  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
    * zabbix-agent-4.0.12-4.45.1
    * zabbix-debugsource-4.0.12-4.45.1
    * zabbix-agent-debuginfo-4.0.12-4.45.1

## References:

  * https://www.suse.com/security/cve/CVE-2024-36469.html
  * https://www.suse.com/security/cve/CVE-2024-42325.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1240676
  * https://bugzilla.suse.com/show_bug.cgi?id=1240678

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20260213/b02bd964/attachment.htm>