CVE-2019-3859Critical· 9.1▾ MidnightAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 1.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
6.3%
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
libssh2 < 1.8.1fedora = 28fedora = 29debian_linux = 8.0debian_linux = 9.0ontap_select_deploy_administration_utilityleap = 15.0leap = 42.3Upgrade past the affected range:
libssh2 1.8.1Connected by shared product, vendor, weakness, or advisory.
CVE-2019-3860Medium· 5.0An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed
CVE-2019-3861Medium· 5.0An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed
CVE-2019-3858Medium· 5.0An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server
CVE-2019-3862High· 7.3An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed
CVE-2019-3863High· 7.5A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side
CVE-2019-3856High· 8.8An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed