Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml (revision 388559) +++ security/vuxml/vuln.xml (working copy) @@ -57,6 +57,36 @@ --> + + libzmq4 -- V3 protocol handler vulnerable to downgrade attacks + + + libzmq4 + 4.0.04.0.6 + 4.1.04.1.1 + + + + +

Pieter Hintjens reports:

+
It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by + sending a ZMTP v2 or earlier header. The library accepts such + connections without applying its security mechanism.
+

+ + + + CVE-2014-9721 + https://github.com/zeromq/libzmq/issues/1273 + http://www.openwall.com/lists/oss-security/2015/05/07/8 + + + 2014-12-04 + 2015-06-05 + + + pcre -- multiple vulnerabilities