Zimbra Update Patches Critical Vulnerabilities

Zimbra on Monday announced patches for several critical-severity vulnerabilities, including a command injection bug disclosed in late June.

The critical command injection impacts the SNMP monitoring component of the collaboration suite if SNMP notifications are enabled and the integrated Swatchdog service is running.

An unauthenticated attacker could send crafted payloads to execute arbitrary OS commands in the background and compromise the email server.

Zimbra Collaboration Suite (ZCS) version 10.1.20 includes a permanent fix for the bug.

The update also patches four cross-site scripting (XSS) defects in the Classic Web Client (Classic UI) that could lead to script execution under certain conditions. The flaws can be exploited via malicious attachment filenames, crafted fields, and crafted attachments.

Zimbra Update Patches Critical Vulnerabilities

Other newsrooms on this story

Related reading

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Other newsrooms on this story

Related reading

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra Patches Critical Code Execution Vulnerability

Zimbra urges customers to patch critical web client XSS flaw

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User…

Zimbra patched a flaw that let hackers hijack accounts just by sending an email

Zimbra Collaboration Suite: Kritische Lücke macht Classic Web Client angreifbar