Unscored CVE-2019-8427 EUVD-2019-17817GHSA-r8rh-cw28-gx6w

daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.

Published Feb 18, 2019 · Updated Sep 16, 2024 · Assigned by mitre

Package: zoneminder Package: zoneminder Ecosystem: Debian Ecosystem: Ubuntu

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	zoneminder	No fix yet	—
Debian 13	zoneminder	No fix yet	—
Debian 12	zoneminder	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	zoneminder	No fix yet	—

References

https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#includesfunctionsphp-daemoncontrol-command-injection