CVE catalog

CVE-2019-13132

zeromq3: CVE-2019-13132

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
42.46% · Oct 25, 2026

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzeromq3sid4.3.5-1fixed
Debianzeromq3forky4.3.5-1fixed
Debianzeromq3trixie4.3.5-1fixed
Debianzeromq3bookworm4.3.4-6fixed
Alpinezeromq3.104.3.2-r0fixed
Alpinezeromq3.114.3.2-r0fixed
Alpinezeromq3.124.3.2-r0fixed
Alpinezeromq3.134.3.2-r0fixed
Alpinezeromq3.144.3.2-r0fixed
Alpinezeromq3.154.3.2-r0fixed
Alpinezeromq3.164.3.2-r0fixed
Alpinezeromq3.174.3.2-r0fixed
Alpinezeromq3.184.3.2-r0fixed
Alpinezeromq3.194.3.2-r0fixed
Alpinezeromq3.204.3.2-r0fixed
Alpinezeromq3.214.3.2-r0fixed
Alpinezeromq3.224.3.2-r0fixed
Alpinezeromq3.234.3.2-r0fixed
Alpinezeromq3.244.3.2-r0fixed
Alpinezeromq3.74.2.5-r1fixed
Alpinezeromq3.84.2.5-r1fixed
Alpinezeromq3.94.3.2-r0fixed
Ubuntuzeromq3pro4.3.2-1vulnerable
Ubuntuzeromq3pro4.3.2-2vulnerable
Ubuntuzeromq3pro4.3.2-2ubuntu1vulnerable
Ubuntuzeromq3pro4.3.2-2ubuntu1.20.04.1~esm1vulnerable
Ubuntuzeromq3pro4.3.2-2ubuntu1.20.04.1~esm2fixed
Ubuntuzeromq3pro3.2.3+dfsg-2vulnerable
Ubuntuzeromq3pro3.2.4+dfsg-1vulnerable
Ubuntuzeromq3pro3.2.4+dfsg-2vulnerable
Ubuntuzeromq3pro3.2.4+dfsg-3vulnerable
Ubuntuzeromq3pro3.2.4+dfsg-4vulnerable
Ubuntuzeromq3pro4.0.3+dfsg-1vulnerable
Ubuntuzeromq3pro4.0.4+dfsg-2vulnerable
Ubuntuzeromq3pro4.0.4+dfsg-2ubuntu0.1vulnerable
Ubuntuzeromq3pro4.0.4+dfsg-2ubuntu0.1+esm1fixed
Ubuntuzeromq316.044.0.5+dfsg-3ubuntu1~gcc5.1vulnerable
Ubuntuzeromq316.044.0.5+dfsg-3ubuntu2vulnerable
Ubuntuzeromq316.044.1.4-7vulnerable
Ubuntuzeromq316.044.1.4-7ubuntu0.1fixed
Ubuntuzeromq318.044.2.1-4ubuntu1vulnerable
Ubuntuzeromq318.044.2.2-1ubuntu2vulnerable
Ubuntuzeromq318.044.2.3-1vulnerable
Ubuntuzeromq318.044.2.3-1build1vulnerable
Ubuntuzeromq318.044.2.5-1vulnerable
Ubuntuzeromq318.044.2.5-1ubuntu0.1vulnerable
Ubuntuzeromq318.044.2.5-1ubuntu0.2fixed
Ubuntuzeromq316.044.0.5+dfsg-3ubuntu1~gcc5.1vulnerable
Ubuntuzeromq316.044.0.5+dfsg-3ubuntu2vulnerable
Ubuntuzeromq316.044.1.4-7vulnerable
Ubuntuzeromq316.044.1.4-7ubuntu0.1fixed
Ubuntuzeromq318.044.2.1-4ubuntu1vulnerable
Ubuntuzeromq318.044.2.2-1ubuntu2vulnerable
Ubuntuzeromq318.044.2.3-1vulnerable
Ubuntuzeromq318.044.2.3-1build1vulnerable
Ubuntuzeromq318.044.2.5-1vulnerable
Ubuntuzeromq318.044.2.5-1ubuntu0.1vulnerable
Ubuntuzeromq318.044.2.5-1ubuntu0.2fixed
Susezeromqlinux enterprise module for basesystem 154.2.3-3.8.1fixed
Susezeromqlinux enterprise module for basesystem 15 sp14.2.3-3.8.1fixed
Opensusezeromqtumbleweed4.3.4-2.2fixed
Susezeromqlinux enterprise server 11 sp3-client-tools4.0.4-3.3.1fixed
Susezeromqlinux enterprise server 11 sp4-client-tools4.0.4-3.3.1fixed
Opensusezeromqleap 15.04.2.3-lp151.5.3.1fixed
Opensusezeromqleap 15.14.2.3-lp151.5.3.1fixed
Susezeromqlinux enterprise desktop 12 sp44.0.4-15.3.1fixed
Susezeromqmanager client tools 124.0.4-15.3.1fixed
Susezeromqlinux enterprise module for advanced systems management 124.0.4-15.3.1fixed
Susezeromqlinux enterprise point of sale 12 sp24.0.4-15.3.1fixed
Susezeromqlinux enterprise software development kit 12 sp44.0.4-15.3.1fixed
Susezeromqlinux enterprise workstation extension 12 sp44.0.4-15.3.1fixed
Susezeromqmanager proxy 3.24.0.4-15.3.1fixed
Susezeromqmanager server 3.24.0.4-15.3.1fixed
Susezeromqenterprise storage 44.0.4-15.3.1fixed
Susezeromqenterprise storage 54.0.4-15.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzeromq3sourcesid4.3.1-5not yet assignedNot reportedNot reported
Debianzeromq3sourceforky4.3.1-5not yet assignedNot reportedNot reported
Debianzeromq3sourcetrixie4.3.1-5not yet assignedNot reportedNot reported
Debianzeromq3sourcebookworm4.3.1-5not yet assignedNot reportedNot reported
Alpinezeromqapk3.104.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.114.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.124.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.134.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.144.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.154.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.164.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.174.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.184.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.194.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.204.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.214.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.224.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.234.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.244.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.74.2.5-r1Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.84.2.5-r1Not reportedALPINE-CVE-2019-13132Not reported
Alpinezeromqapk3.94.3.2-r0Not reportedALPINE-CVE-2019-13132Not reported
Ubuntuzeromq3debpro4.3.2-2ubuntu1.20.04.1~esm2Not reportedUSN-4920-1Not reported
Ubuntuzeromq3debpro4.0.4+dfsg-2ubuntu0.1+esm1Not reportedUBUNTU-CVE-2019-13132Not reported
Ubuntuzeromq3deb16.044.1.4-7ubuntu0.1Not reportedUBUNTU-CVE-2019-13132Not reported
Ubuntuzeromq3deb18.044.2.5-1ubuntu0.2Not reportedUBUNTU-CVE-2019-13132Not reported
Ubuntuzeromq3deb16.044.1.4-7ubuntu0.1Not reportedUSN-4050-1Not reported
Ubuntuzeromq3deb18.044.2.5-1ubuntu0.2Not reportedUSN-4050-1Not reported
Susezeromqrpmlinux enterprise module for basesystem 154.2.3-3.8.1Not reportedSUSE-SU-2019:1776-1Not reported
Susezeromqrpmlinux enterprise module for basesystem 15 sp14.2.3-3.8.1Not reportedSUSE-SU-2019:1776-1Not reported
Opensusezeromqrpmtumbleweed4.3.4-2.2Not reportedOPENSUSE-SU-2024:11540-1Not reported
Susezeromqrpmlinux enterprise server 11 sp3-client-tools4.0.4-3.3.1Not reportedSUSE-SU-2019:14117-1Not reported
Susezeromqrpmlinux enterprise server 11 sp4-client-tools4.0.4-3.3.1Not reportedSUSE-SU-2019:14117-1Not reported
Opensusezeromqrpmleap 15.04.2.3-lp151.5.3.1Not reportedOPENSUSE-SU-2019:1767-1Not reported
Opensusezeromqrpmleap 15.14.2.3-lp151.5.3.1Not reportedOPENSUSE-SU-2019:1767-1Not reported
Susezeromqrpmlinux enterprise desktop 12 sp44.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmmanager client tools 124.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmlinux enterprise module for advanced systems management 124.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmlinux enterprise point of sale 12 sp24.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmlinux enterprise software development kit 12 sp44.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmlinux enterprise workstation extension 12 sp44.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmmanager proxy 3.24.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmmanager server 3.24.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmenterprise storage 44.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported
Susezeromqrpmenterprise storage 54.0.4-15.3.1Not reportedSUSE-SU-2019:1785-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libzmq5]Unknown

    Source package: [zeromq]

    Details (1)

    • 4.3.5-1.11 · x86_64 · tumbleweed

      Unknown · Fixed: 4.3.4-2.2

      Version impact unknown

      dsa · zeromq · opensuse · tumbleweed

  • [libzmq5-32bit]Unknown

    Source package: [zeromq]

    Details (1)

    • 4.3.5-1.11 · x86_64 · tumbleweed

      Unknown · Fixed: 4.3.4-2.2

      Version impact unknown

      dsa · zeromq · opensuse · tumbleweed

  • [zeromq-devel]Unknown

    Source package: [zeromq]

    Details (1)

    • 4.3.5-1.11 · x86_64 · tumbleweed

      Unknown · Fixed: 4.3.4-2.2

      Version impact unknown

      dsa · zeromq · opensuse · tumbleweed

  • [zeromq-tools]Unknown

    Source package: [zeromq]

    Details (1)

    • 4.3.5-1.11 · x86_64 · tumbleweed

      Unknown · Fixed: 4.3.4-2.2

      Version impact unknown

      dsa · zeromq · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libzmq3-dev]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.4-6 · amd64 · bookworm

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

    • 4.3.4-6 · arm64 · bookworm

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

  • [libzmq5]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.4-6 · amd64 · bookworm

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

    • 4.3.4-6 · arm64 · bookworm

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

[Debian 13 (Trixie)]

  • [libzmq3-dev]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.5-1+b3 · amd64 · trixie

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · 13

    • 4.3.5-1+b3 · arm64 · trixie

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · 13

  • [libzmq5]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.5-1+b3 · amd64 · trixie

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · 13

    • 4.3.5-1+b3 · arm64 · trixie

      Fixed · Fixed: 4.3.1-5

      dsa · zeromq3 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]