PT-2015-4365 · Zeromq+2 · Libzmq+2

Hintjens · Published 2015-05-10 · Updated 2024-06-15 · CVE-2014-9721

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions libzmq versions prior to 4.0.6 libzmq versions 4.1.x prior to 4.1.1

Description The issue allows remote attackers to conduct downgrade attacks, bypassing security mechanisms of the ZMTP v3 protocol by using a ZMTP v2 or earlier header.

Recommendations For libzmq versions prior to 4.0.6, update to version 4.0.6 or later. For libzmq versions 4.1.x prior to 4.1.1, update to version 4.1.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-1102

CVE-2014-9721

DSA-3255-1

OPENSUSE-SU-2024:10038-1

SUSE-FU-2022:0444-1

SUSE-FU-2022:0445-1

SUSE-SU-2015:1510-1

SUSE-SU-2015_1510-1

Affected Products

Alt Linux

Suse

Libzmq

References · 31

• https://cve.org/CVERecord?id=CVE-2014-9721 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10038-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1510-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9721 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3255-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9721 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9721 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9721 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1102 · Vendor Advisory
• http://debian.org/security/2015/dsa-3255 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3255-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/zeromq3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9721 · Security Note