VUPEN Security Team reported: [1] http://www.vupen.com/english/advisories/2010/1908 multiple cross-site scripting (XSS) flaws, present in Zabbix code. An attacker could use this flaw to execute arbitrary scripting code. References: [2] https://support.zabbix.com/browse/ZBX-2326 [3] http://www.zabbix.com/forum/showthread.php?p=68770
This issue affects the version of the zabbix package, as shipped with Fedora release of 13. Please fix / rebase to Zabbix v1.8.3rc1 / Zabbix v1.8.3rc3 versions.
Created zabbix tracking bugs for this issue Affects: fedora-13 [bug 620809]
fixed in https://admin.fedoraproject.org/updates/zabbix-1.8.2-2.fc13 https://admin.fedoraproject.org/updates/zabbix-1.8.2-3.fc14 http://koji.fedoraproject.org/koji/buildinfo?buildID=189329 (rawhide)
zabbix 1.4.7 was retired and blocked in EPEL 5, as there is no upstream support for this version. This was the only remaining version potentially or actually prone to this issue, thus closing. Users are encouraged to update to zabbix20 or later.