rpm package
opensuse/libssh2_org&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/libssh2_org&distro=openSUSE%20Tumbleweed
Vulnerabilities (23)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-66035 | Hig | 7.5 | < 1.11.1-4.1 | 1.11.1-4.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size dur | |
| CVE-2026-66034 | Hig | 7.5 | < 1.11.1-4.1 | 1.11.1-4.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_f | |
| CVE-2026-66033 | Hig | 7.5 | < 1.11.1-4.1 | 1.11.1-4.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. A | |
| CVE-2026-66032 | Hig | 8.8 | < 1.11.1-4.1 | 1.11.1-4.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with | |
| CVE-2026-58051 | Med | 6.5 | < 1.11.1-4.1 | 1.11.1-4.1 | Jun 28, 2026 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server of | |
| CVE-2026-58050 | Hig | 7.0 | < 1.11.1-4.1 | 1.11.1-4.1 | Jun 28, 2026 | libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersiz | |
| CVE-2025-15661 | Med | 6.5 | < 1.11.1-3.1 | 1.11.1-3.1 | Jun 18, 2026 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted | |
| CVE-2026-55200 | Hig | 8.1 | < 1.11.1-3.1 | 1.11.1-3.1 | Jun 17, 2026 | libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt h | |
| CVE-2026-55199 | Med | 5.9 | < 1.11.1-3.1 | 1.11.1-3.1 | Jun 17, 2026 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A ma | |
| CVE-2026-7598 | Hig | 7.3 | < 1.11.1-3.1 | 1.11.1-3.1 | May 1, 2026 | A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The n | |
| CVE-2023-48795 | Med | 5.9 | < 1.11.0-2.1 | 1.11.0-2.1 | Dec 18, 2023 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end | |
| CVE-2019-17498 | Hig | 8.1 | < 1.9.0-3.6 | 1.9.0-3.6 | Oct 21, 2019 | In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive inf | |
| CVE-2019-3861 | Med | 5.0 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 25, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memor | |
| CVE-2019-3860 | Med | 5.0 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 25, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. | |
| CVE-2019-3857 | Hig | 8.8 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 25, 2019 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system wh | |
| CVE-2019-3856 | Hig | 8.8 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 25, 2019 | An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the | |
| CVE-2019-3863 | Hig | 7.5 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 25, 2019 | A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to co | |
| CVE-2019-3858 | Med | 5.0 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 21, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. | |
| CVE-2019-3855 | Hig | 8.8 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 21, 2019 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the serv | |
| CVE-2019-3862 | Hig | 7.3 | < 1.9.0-3.6 | 1.9.0-3.6 | Mar 21, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client m |
- affected < 1.11.1-4.1fixed 1.11.1-4.1
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size dur
- affected < 1.11.1-4.1fixed 1.11.1-4.1
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_f
- affected < 1.11.1-4.1fixed 1.11.1-4.1
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. A
- affected < 1.11.1-4.1fixed 1.11.1-4.1
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with
- affected < 1.11.1-4.1fixed 1.11.1-4.1
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server of
- affected < 1.11.1-4.1fixed 1.11.1-4.1
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersiz
- affected < 1.11.1-3.1fixed 1.11.1-3.1
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted
- affected < 1.11.1-3.1fixed 1.11.1-3.1
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt h
- affected < 1.11.1-3.1fixed 1.11.1-3.1
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A ma
- affected < 1.11.1-3.1fixed 1.11.1-3.1
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The n
- affected < 1.11.0-2.1fixed 1.11.0-2.1
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end
- affected < 1.9.0-3.6fixed 1.9.0-3.6
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive inf
- affected < 1.9.0-3.6fixed 1.9.0-3.6
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memor
- affected < 1.9.0-3.6fixed 1.9.0-3.6
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
- affected < 1.9.0-3.6fixed 1.9.0-3.6
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system wh
- affected < 1.9.0-3.6fixed 1.9.0-3.6
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the
- affected < 1.9.0-3.6fixed 1.9.0-3.6
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to co
- affected < 1.9.0-3.6fixed 1.9.0-3.6
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
- affected < 1.9.0-3.6fixed 1.9.0-3.6
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the serv
- affected < 1.9.0-3.6fixed 1.9.0-3.6
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client m
Page 1 of 2