未評価
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, runnin...
CVE-2019-13132
SecPulse初出
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2019-13132 zeromq 修正版: 4.3.2-r0
- Debian DEBIAN-CVE-2019-13132 zeromq3 修正版: 4.3.1-5
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
参照URL
- advisory openwall.com
- advisory securityfocus.com
- advisory github.com
- advisory github.com
- advisory lists.debian.org
- advisory seclists.org
- advisory security.gentoo.org
- advisory usn.ubuntu.com
- advisory debian.org
- web lists.opensuse.org
- web fangpenlin.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web news.ycombinator.com