CVE-2019-6250 describes a critical pointer overflow vulnerability in ZeroMQ libzmq versions 4.2.x and 4.3.x prior to 4.3.1, affecting various Debian distributions. This flaw, specifically an integer overflow in zmq::v2_decoder_t::size_ready, allows an authenticated attacker to overwrite memory beyond a buffer's bounds. With a CVSS score of 8.8 (High), the vulnerability permits remote code execution by injecting OS commands into adjacent data structures, bypassing typical control flow manipulation. While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.2.0, <= 4.2.5CPE matchmatch criteria | cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:* | ||
>= 4.3.0, < 4.3.1CPE matchmatch criteria | cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.