oss-sec mailing list archives
CVE-2019-13132: zeromq/libzmq: denial of service via stack overflow with arbitrary data
From: Luca Boccassi <bluca () debian org>
Date: Mon, 08 Jul 2019 17:23:43 +0100
Hello, A security vulnerability has been reported in libzmq/zeromq. CVE-2019-13132: a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations. All versions from 4.0.0 and upwards are affected. Thank you Fang-Pen Lin for finding the issue and reporting it! The following upstream releases fixes the issue and will be shortly available: https://github.com/zeromq/libzmq/releases/tag/v4.3.2 https://github.com/zeromq/zeromq4-x/releases/tag/v4.0.9 https://github.com/zeromq/zeromq4-1/releases/tag/v4.1.7 Individual backported patches can be found on the upstream bug tracker, and have been sent separately to the security teams of various distributions: https://github.com/zeromq/libzmq/issues/3558 The programs to reproduce the issue will be shared on the 15th of July. -- Kind regards, Luca Boccassi
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- CVE-2019-13132: zeromq/libzmq: denial of service via stack overflow with arbitrary data Luca Boccassi (Jul 08)