In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4...
Critical severity
Unreviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Apr 12, 2024
Description
Published by the National Vulnerability Database
Jul 10, 2019
Published to the GitHub Advisory Database
May 24, 2022
Last updated
Apr 12, 2024
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
References