CVE-2014-9721

Published: Jun 3, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.

Affected (2)

Products: Zeromq: Zeromq

Zeromq

1 product

Zeromq

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Zeromq Zeromq	Up to 4.0.5
Zeromq Zeromq	Version 4.1.0 rc1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3255

Source: cve@mitre.org

https://github.com/zeromq/libzmq/issues/1273

Source: cve@mitre.org

https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html