PT-2024-12177 · Zscaler · Zscaler Client Connector

Published 2024-05-02 · Updated 2026-02-17 · CVE-2023-28798

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector (affected versions not specified)

Description An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2023-28798

Affected Products

Zscaler Client Connector

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28798 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28798 · Vendor Advisory
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851 · Vendor Advisory
• https://twitter.com/linuxpatch/status/1786034668594213279 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1786042364563231054 · Twitter Post
• https://t.me/cveNotify/152215 · Telegram Post
• https://twitter.com/CVEnew/status/1786027498536607876 · Twitter Post