5.0
Medium
CVE-2019-3860 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed
Description
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libssh2 | 1.8.1 | No fix stated |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- www.libssh2.org www.libssh2.org
- bugzilla.redhat.com bugzilla.redhat.com
- [debian-lts-announce] 20190326 [SECURITY] [DLA 1730-1] libssh2 security update lists.debian.org
- security.netapp.com security.netapp.com
- openSUSE-SU-2019:1075 lists.opensuse.org
- openSUSE-SU-2019:1109 lists.opensuse.org
- FEDORA-2019-3348cb4934 lists.fedoraproject.org
- DSA-4431 www.debian.org
- 20190415 [SECURITY] [DSA 4431-1] libssh2 security update seclists.org
- openSUSE-SU-2019:1640 lists.opensuse.org
- [debian-lts-announce] 20190730 [SECURITY] [DLA 1730-4] libssh2 regression update lists.debian.org
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified
Other CVEs of libssh2
The 9 CVEs of libssh2 →
CVE-2019-3856
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the…
7.5
High
CVE-2019-3857
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way…
7.5
High
CVE-2019-3861
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value…
5.0
Medium
CVE-2019-3863
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side
7.5
High