3party/libzmq
0
0
Fork 0
mirror of https://github.com/zeromq/libzmq.git synced 2025-01-14 09:47:56 +08:00
Code Issues Projects Releases Wiki Activity

Problem: latest fixes missing from NEWS

Browse Source 
Solution: add them
This commit is contained in:
Luca Boccassi 2019-07-02 12:53:56 +01:00
parent e65c14e20e
commit 62e02cdea3
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
NEWS
View File

@ -1,6 +1,19 @@
0MQ version 4.0.9 stable, released on 2016/xx/xx
================================================
* CVE-2019-13132: a remote, unauthenticated client connecting to a
libzmq application, running with a socket listening with CURVE
encryption/authentication enabled, may cause a stack overflow and
overwrite the stack with arbitrary data, due to a buffer overflow in
the library. Users running public servers with the above configuration
are highly encouraged to upgrade as soon as possible, as there are no
known mitigations. All versions from 4.0.0 and upwards are affected.
* Fix documentation to remove mention of features that are not available in
4.0.x.
* Fix parsing application metadata when using CURVE.
0MQ version 4.0.8 stable, released on 2016/06/17
================================================