rpm package
suse/libssh2_org&distro=SUSE Linux Enterprise Software Development Kit 11 SP4
pkg:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4
Vulnerabilities (10)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-3856 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 25, 2019 | An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the | ||
| CVE-2019-3857 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 25, 2019 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system wh | ||
| CVE-2019-3860 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 25, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. | ||
| CVE-2019-3861 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 25, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memor | ||
| CVE-2019-3863 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 25, 2019 | A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to co | ||
| CVE-2019-3858 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 21, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. | ||
| CVE-2019-3855 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 21, 2019 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the serv | ||
| CVE-2019-3862 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 20, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client m | ||
| CVE-2019-3859 | — | < 1.4.3-17.3.1 | 1.4.3-17.3.1 | Mar 20, 2019 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. | ||
| CVE-2016-0787 | Med | 5.9 | < 1.2.9-4.2.6.1 | 1.2.9-4.2.6.1 | Apr 13, 2016 | The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug." |
- CVE-2019-3856Mar 25, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the
- CVE-2019-3857Mar 25, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system wh
- CVE-2019-3860Mar 25, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
- CVE-2019-3861Mar 25, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memor
- CVE-2019-3863Mar 25, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to co
- CVE-2019-3858Mar 21, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
- CVE-2019-3855Mar 21, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the serv
- CVE-2019-3862Mar 20, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client m
- CVE-2019-3859Mar 20, 2019affected < 1.4.3-17.3.1fixed 1.4.3-17.3.1
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
- affected < 1.2.9-4.2.6.1fixed 1.2.9-4.2.6.1
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."