rpm package
opensuse/libssh2_org&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/libssh2_org&distro=openSUSE%20Leap%2016.0
Vulnerabilities (10)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-66035 | Hig | 7.5 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size dur | |
| CVE-2026-66034 | Hig | 7.5 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_f | |
| CVE-2026-66033 | Hig | 7.5 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. A | |
| CVE-2026-66032 | Hig | 8.8 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | Jul 24, 2026 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with | |
| CVE-2026-58051 | Med | 6.5 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | Jun 28, 2026 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server of | |
| CVE-2026-58050 | Hig | 7.0 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | Jun 28, 2026 | libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersiz | |
| CVE-2025-15661 | Med | 6.5 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | Jun 18, 2026 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted | |
| CVE-2026-55200 | Hig | 8.1 | < 1.11.1-160000.4.1 | 1.11.1-160000.4.1 | Jun 17, 2026 | libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt h | |
| CVE-2026-55199 | Med | 5.9 | < 1.11.1-160000.4.1 | 1.11.1-160000.4.1 | Jun 17, 2026 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A ma | |
| CVE-2026-7598 | Hig | 7.3 | < 1.11.1-160000.5.1 | 1.11.1-160000.5.1 | May 1, 2026 | A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The n |
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size dur
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_f
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. A
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server of
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersiz
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted
- affected < 1.11.1-160000.4.1fixed 1.11.1-160000.4.1
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt h
- affected < 1.11.1-160000.4.1fixed 1.11.1-160000.4.1
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A ma
- affected < 1.11.1-160000.5.1fixed 1.11.1-160000.5.1
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The n