CVE-2019-6250

A pointer overflow, with code execution, was discovered in ZeroMQ libzmq
(aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp
zmq::v2_decoder_t::size_ready integer overflow allows an authenticated
attacker to overwrite an arbitrary amount of bytes beyond the bounds of a
buffer, which can be leveraged to run arbitrary code on the target system.
The memory layout allows the attacker to inject OS commands into a data
structure located immediately after the problematic buffer (i.e., it is not
necessary to use a typical buffer-overflow exploitation technique that
changes the flow of control).

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919098&gt;
• <https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531&gt;

Notes