CVE-2019-13132

Published: Jul 10, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.

Affected (12)

Products: Zeromq: Libzmq · Debian: Debian Linux · Canonical: Ubuntu Linux · +1 more

Show all products

Zeromq: Libzmq · Debian: Debian Linux · Canonical: Ubuntu Linux · Fedoraproject: Fedora

1 product

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Zeromq Libzmq	Before 4.0.9
Zeromq Libzmq	From 4.1.0 to 4.1.7
Zeromq Libzmq	From 4.2.0 to 4.3.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10
Canonical Ubuntu Linux	Version 19.04

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (30)

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00033.html

Source: cve@mitre.org

Broken Link

http://www.openwall.com/lists/oss-security/2019/07/08/6

Source: cve@mitre.org

Mailing ListRelease NotesThird Party Advisory

http://www.securityfocus.com/bid/109284

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

https://fangpenlin.com/posts/2024/04/07/how-i-discovered-a-9-point-8-critical-security-vulnerability-in-zeromq-with-mostly-pure-luck/

Source: cve@mitre.org

https://github.com/zeromq/libzmq/issues/3558

Source: cve@mitre.org

Third Party Advisory

https://github.com/zeromq/libzmq/releases

Source: cve@mitre.org

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/07/msg00007.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVCTNUEOFFZUNJOXFCYCF3C6Y6NDILI3/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MK7SJYDJ7MMRRRPCUN3SCSE7YK6ZSHVS/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6HINI24SL7CU6XIJWUOSGTZWEFOOL7X/

Source: cve@mitre.org

https://news.ycombinator.com/item?id=39970716

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Jul/13

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201908-17

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4050-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4477

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00033.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.openwall.com/lists/oss-security/2019/07/08/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListRelease NotesThird Party Advisory

http://www.securityfocus.com/bid/109284

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

https://fangpenlin.com/posts/2024/04/07/how-i-discovered-a-9-point-8-critical-security-vulnerability-in-zeromq-with-mostly-pure-luck/

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/zeromq/libzmq/issues/3558

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/zeromq/libzmq/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/07/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVCTNUEOFFZUNJOXFCYCF3C6Y6NDILI3/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MK7SJYDJ7MMRRRPCUN3SCSE7YK6ZSHVS/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6HINI24SL7CU6XIJWUOSGTZWEFOOL7X/

Source: af854a3a-2127-422b-91ae-364da2661108

https://news.ycombinator.com/item?id=39970716

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2019/Jul/13

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201908-17

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4050-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2019/dsa-4477

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.