Unrated
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, runnin...
CVE-2019-13132
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2019-13132 zeromq Fixed in: 4.3.2-r0
- Debian DEBIAN-CVE-2019-13132 zeromq3 Fixed in: 4.3.1-5
Original description The description as published by the source.
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
References
- advisory openwall.com
- advisory securityfocus.com
- advisory github.com
- advisory github.com
- advisory lists.debian.org
- advisory seclists.org
- advisory security.gentoo.org
- advisory usn.ubuntu.com
- advisory debian.org
- web lists.opensuse.org
- web fangpenlin.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web news.ycombinator.com