Packages / Debian 13 (Trixie) / Source / doc / zoneminder

Source Package: zoneminder (1.36.35+dfsg1-1)

video camera security and surveillance solution (documentation)

The following binary packages are built from this source package:

  • zoneminder-doc

    video camera security and surveillance solution (documentation)

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVESeverityVersion impact
[CVE-2026-102608]

Published:

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg

Critical(9)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-102607]

Published:

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a

High(8.8)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-104198]

Published:

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php.

Medium(5.3)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-102297]

Published:

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame re

Medium(5.3)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-102296]

Published:

ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers b

High(8.3)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2024-58386]

Published:

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated

High(7.1)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-54258]

Published:

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` an

Medium(6.5)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-76060]

Published:

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP

High(8.8)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-72556]

Published:

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelet

High(8.8)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2026-27470]

Published:

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the w

High(8.8)Affected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    nvd · zoneminder · debian · 13

[CVE-2025-65791]

Published:

zoneminder: CVE-2025-65791

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

[CVE-2023-31493]

Published:

zoneminder: CVE-2023-31493

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

[CVE-2019-8429]

Published:

zoneminder: CVE-2019-8429

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

[CVE-2019-8423]

Published:

zoneminder: CVE-2019-8423

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

[CVE-2019-8425]

Published:

zoneminder: CVE-2019-8425

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

[CVE-2019-8427]

Published:

zoneminder: CVE-2019-8427

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

[CVE-2019-7351]

Published:

zoneminder: CVE-2019-7351

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

[CVE-2019-7350]

Published:

zoneminder: CVE-2019-7350

LowAffected
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Affected

    dsa · zoneminder · debian · 13

Fixed and unaffected versions (2)
CVESeverityVersion impact
[CVE-2024-43360]

Published:

zoneminder: CVE-2024-43360

LowFixed
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Fixed · Fixed: 1.36.35+dfsg1-1

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Fixed · Fixed: 1.36.35+dfsg1-1

    dsa · zoneminder · debian · 13

[CVE-2024-43359]

Published:

zoneminder: CVE-2024-43359

LowFixed
Details (2)

  • 1.36.35+dfsg1-1 · all · trixie

    Fixed · Fixed: 1.36.35+dfsg1-1

    dsa · zoneminder · debian · 13

  • 1.36.35+dfsg1-1 · all · trixie

    Fixed · Fixed: 1.36.35+dfsg1-1

    dsa · zoneminder · debian · 13

[Next results]

Last synced:

[CVE catalog]

Sources

  • Debian 13 (Trixie) main amd64Sep 1, 2026

    Authoritative source; repository metadata signature verified

    Signature evidence

    trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3

    Repository-signature verification record
    Signed-object SHA-256
    98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
    Signer fingerprint
    4CB50190207B4758A3F73A796ED0E7B82643E131
    Keyring revision
    debian-archive-keyring.gpg
    SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
    Tool and policy
    gpgv (GnuPG) 2.4.9
    openfactory-software-catalog-signature-v1
    Verification time
    Sep 1, 2026
    Repository metadata hash linkage
    Path
    main/binary-amd64/Packages.xz
    Expected SHA-256
    3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
    Observed SHA-256
    3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
    Result
    match verified
  • Debian 13 (Trixie) main arm64Sep 1, 2026

    Authoritative source; repository metadata signature verified

    Signature evidence

    trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908

    Repository-signature verification record
    Signed-object SHA-256
    98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
    Signer fingerprint
    4CB50190207B4758A3F73A796ED0E7B82643E131
    Keyring revision
    debian-archive-keyring.gpg
    SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
    Tool and policy
    gpgv (GnuPG) 2.4.9
    openfactory-software-catalog-signature-v1
    Verification time
    Sep 1, 2026
    Repository metadata hash linkage
    Path
    main/binary-arm64/Packages.xz
    Expected SHA-256
    753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
    Observed SHA-256
    753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
    Result
    match verified