9.8

CVE-2019-13132

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.

Data is provided by the National Vulnerability Database (NVD)
Zeromq ≫ Libzmq Version < 4.0.9
Zeromq ≫ Libzmq Version >= 4.1.0 < 4.1.7
Zeromq ≫ Libzmq Version >= 4.2.0 < 4.3.2
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Canonical ≫ Ubuntu Linux Version19.04
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 23.22% 0.957
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.openwall.com/lists/oss-security/2019/07/08/6
Third Party Advisory
Mailing List
Release Notes
http://www.securityfocus.com/bid/109284
Third Party Advisory
Broken Link
VDB Entry
https://github.com/zeromq/libzmq/releases
Third Party Advisory
Release Notes
https://seclists.org/bugtraq/2019/Jul/13
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4050-1/
Third Party Advisory