ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcpread, a different vulnerability than CVE-2021-20235.

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.

A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2decoder.cpp zmq::v2decodert::sizeready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).

A flaw was found in zeromq before 4.3.3. The use of a static allocator with ZMTP v1 packets may lead to a heap based overflow.

References:

https://github.com/zeromq/libzmq/pull/3902 https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21984

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

A flaw was found in zeromq before 4.3.3. Messages with metadata are never processed by PUB sockets, but the metadata is kept referenced in the PUB object and never freed leading to memory leaks.

References:

https://github.com/zeromq/libzmq/pull/3935 https://github.com/zeromq/libzmq/security/advisories/GHSA-4p5v-h92w-6wxw https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22344

A flaw was found in zeromq before 4.3.3. When a pipe processes a delimiter and is already not in active state but still has an unfinished message, the message is leaked causing a crash.

References:

https://github.com/zeromq/libzmq/pull/3918 https://github.com/zeromq/libzmq/security/advisories/GHSA-wfr2-29gj-5w87 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22037 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22123