libzmq3-dev needs to be backported from disco to xenial because of zmq vulnerabilities, as documented here - https://github.com/zcore-coin/zcore-source/issues/8

[Ray Qiu]

https://github.com/zcore-coin/zcore-source/issues/8

Description:
A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).

Exploit details
Now that msg_size_ has been set to a very high value, the attacker is allowed to send this amount of bytes, and libzmq will copy it to its internal buffer without any further checks.

This means that it's possible to write beyond the bounds of the allocated space.

However, for the exploit this is not necessary to corrupt memory beyond the buffer proper.

P.o.C
Remote code execution vulnerability #3351

how to fix it:
Update zmq to 4.3.1

[Dan Streetman (ddstreet)]

Hello,

the backports process has recently been updated, please see the new documentation:
https://wiki.ubuntu.com/UbuntuBackports

I'm closing this bug, but please feel free to open a new bug (or reopen this bug) using the new process, if appropriate.