Description
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zscaler | Client Connector | 4.6 – < 4.6.0.486, 4.7 – < 4.7.0.350, 4.8 – < 4.8.0.267, 4.9 – < 4.9.0.412 | 4.6.0.486 |