Stay Secure with the Latest Linux Advisories

security advisorySuSEtiming attack

SUSE Zabbix Low Security Update CVE-2024-36469 CVE-2024-42325

An update that solves two vulnerabilities can now be installed.. # Security update for zabbix Announcement ID: SUSE-SU-2026:0483-1 Release Date: 2026-02-12T16:34:19Z Rating: low References: * bsc#1240676 * bsc#1240678 Cross-References: * CVE-2024-36469 * CVE-2024-42325 CVSS scores: * CVE-2024-36469 ( SUSE ): 2.3 CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2024-36469 ( SUSE ): 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-36469 ( NVD ): 2.3 CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-36469 ( NVD ): 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-42325 ( SUSE ): 2.1 CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2024-42325 ( SUSE ): 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N * CVE-2024-42325 ( NVD ): 2.1 CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-42325 ( NVD ): 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for zabbix fixes the following issues: * CVE-2024-36469: Introduced clamping for mitigation of timing attacks. (bsc#1240676) * CVE-2024-42325: Restricted access to user fields using user.get API method for users of User and Admin type, and restricted access to alert entities using alert.get API method for users of User and Admin types. (bsc#1240678) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypperpatch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-483=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * zabbix-agent-4.0.12-4.45.1 * zabbix-debugsource-4.0.12-4.45.1 * zabbix-agent-debuginfo-4.0.12-4.45.1 ## References: * https://www.suse.com/security/cve/CVE-2024-36469.html * https://www.suse.com/security/cve/CVE-2024-42325.html * https://bugzilla.suse.com/show_bug.cgi?id=1240676 * https://bugzilla.suse.com/show_bug.cgi?id=1240678 . Update available for Zabbix addressing two issues, including timing attacks and access restrictions for users in SUSE.. SUSE, Zabbix, security update, user access, timing attack. . Severity: Low. LinuxSecurity.com Team

Feb 13, 2026 •Low SuSE