{"id":"MGASA-2021-0159","aliases":[],"status":"published","title":"Updated zeromq packages fix security vulnerabilities","description":"Memory leak in client induced by malicious server without CURVE/ZAP\n(rhbz#1921972).\n\nStack overflow on server running PUB/XPUB socket (rhbz#1921976).\n\nHeap overflow when receiving malformed ZMTP v1 packets (rhbz#1921983).\n\nMemory leaks via metadata messages processed by PUB sockets (rhbz#1921989).\n\nAlso, the cppzmq package has been rebuilt to fix the broken dependency on\nzeromq-devel.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-03-30T20:08:49Z","modified":"2026-04-16T04:25:18Z","fixes":[{"ecosystem":"Mageia:7","package":"zeromq","fixed_in":["4.3.4-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"cppzmq","fixed_in":["4.3.0-2.4.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"zeromq","fixed_in":["4.3.4-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"cppzmq","fixed_in":["4.7.1-1.1.mga8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"cppzmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.4.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"cppzmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-1.1.mga8"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2021-0159.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28320","tags":["report"]},{"url":"https://lists.zeromq.org/pipermail/zeromq-announce/2021-January/000068.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/A73URKLEFEB5USSGSLKTP7XWE5JUKSB7/","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2021-0159","title":"Updated zeromq packages fix security vulnerabilities","description":"Memory leak in client induced by malicious server without CURVE/ZAP\n(rhbz#1921972).\n\nStack overflow on server running PUB/XPUB socket (rhbz#1921976).\n\nHeap overflow when receiving malformed ZMTP v1 packets (rhbz#1921983).\n\nMemory leaks via metadata messages processed by PUB sockets (rhbz#1921989).\n\nAlso, the cppzmq package has been rebuilt to fix the broken dependency on\nzeromq-devel.\n","status":"published","published":"2021-03-30T20:08:49Z","modified":"2026-04-16T04:25:18.944357Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}