Bugzilla – Bug 1188236
VUL-0: CVE-2020-36400: zeromq: heap-based buffer overflow in zmq:tcp_read
Last modified: 2021-07-13 08:22:42 UTC
rh#1980260 ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read by resizing a fixed static allocator, a different vulnerability than CVE-2021-20235. Upstream Reference: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 Upstream fix: https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306 References: https://bugzilla.redhat.com/show_bug.cgi?id=1980260 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36400 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36400 https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306 https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml
does not affect SLE and openSUSE:Factory is already updated to 4.3.4.
closing