CVE-2019-6250
zeromq3 - security update
Description
A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).
How to fix CVE-2019-6250
To remediate CVE-2019-6250, upgrade the affected package to a fixed version below.
- —upgrade to 4.3.1-r0 or later
- —upgrade to 4.3.1-1 or later
- —upgrade to 4.2.1-4+deb9u1 or later
Is CVE-2019-6250 being exploited?
Moderate — EPSS is 15.6%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (3)
- from 0, < 4.3.1-r0
- from 0, < 4.3.1-1
- from 0, < 4.2.1-4+deb9u1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |