CVE-2019-6250

Name of the Vulnerable Software and Affected Versions ZeroMQ libzmq versions 4.2.x through 4.3.0

Description The issue is caused by an integer overflow in the ZeroMQ libzmq library, which can be exploited by a remote attacker to execute arbitrary code. Specifically, a v2 decoder t::size ready integer overflow in v2 decoder.cpp allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer. This can be leveraged to run arbitrary code on the target system by injecting OS commands into a data structure located immediately after the problematic buffer.

Recommendations For ZeroMQ libzmq versions 4.2.x through 4.3.0, update to version 4.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the v2 decoder t::size ready function to minimize the risk of exploitation.