| Summary: | <net-libs/zeromq-4.3.2: denial of service via stack overflow with arbitrary data overwrite (CVE-2019-13132) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Thomas Deutschmann (RETIRED) <whissi> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | CC: | whissi |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://marc.info/?l=oss-security&m=156260342300969&w=2 | ||
| Whiteboard: | B1 [glsa+ cve] | ||
| Package list: |
net-libs/zeromq-4.3.2
|
Runtime testing required: | --- |
| Deadline: | 2019-07-08 | ||
|
Description
Thomas Deutschmann (RETIRED)
2019-07-07 19:51:49 UTC
CVE-2019-13132: a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations. All versions from 4.0.0 and upwards are affected. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d85aa97574742adc3d17a2300fb7006f01486238 commit d85aa97574742adc3d17a2300fb7006f01486238 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2019-07-09 00:32:43 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2019-07-09 00:33:17 +0000 net-libs/zeromq: amd64 & x86 stable (#689426) Bug: https://bugs.gentoo.org/689426 Package-Manager: Portage-2.3.68, Repoman-2.3.16 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> net-libs/zeromq/zeromq-4.3.2.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5e5e3d0670568e4ad8d047a773195483287559bb commit 5e5e3d0670568e4ad8d047a773195483287559bb Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2019-07-09 00:28:07 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2019-07-09 00:33:16 +0000 net-libs/zeromq: bump to v4.3.2 Bug: https://bugs.gentoo.org/689426 Package-Manager: Portage-2.3.68, Repoman-2.3.16 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> net-libs/zeromq/Manifest | 1 + net-libs/zeromq/zeromq-4.3.2.ebuild | 60 +++++++++++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+) sparc stable ia64 stable hppa stable ppc stable ppc64 stable arm64 stable arm stable This issue was resolved and addressed in GLSA 201908-17 at https://security.gentoo.org/glsa/201908-17 by GLSA coordinator Aaron Bauman (b-man). re-opened for cleanup Repository is now clean, https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=db77a1dc3ae7e03aaa2b8035b6a410e63380bb72 |
