Slackware 14.2 / current : libssh2 (SSA:2019-077-01)

New libssh2 packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-077-01. The text itself is copyright C Slackware Linux, Inc...

[slackware-security] libssh2

New libssh2 packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libssh2-1.8.1-i586-1slack14.2.txz: Upgraded. Fixed several security issues. For more information, see:...

libssh2 Multiple Security Vulnerabilities

Description libssh2 is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, perform unauthorized actions, cause denial-of-service conditions, retrieve sensitive information; other attacks may also be possible. Technologies Affected Oracle Linux...

PT-2019-3586

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description A flaw in libssh2 allows a server to send multiple keyboard interactive response messages with a total length greater than the maximum unsigned char characters. This can cause an out of bounds memory...

libssh2 -- multiple issues

libssh2 developers report: Defend against possible integer overflows in compmethodzlibdecomp. Defend against writing beyond the end of the payload in libssh2transportread. Sanitize paddinglength - libssh2transportread. This prevents an underflow resulting in a potential out-of-bounds read if a...

[SECURITY] [DSA 4377-3] rssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4377-3 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 22, 2019 https://www.debian.org/security/faq - -...

Security Bulletin: Vulnerability in libssh2 affects IBM Flex System Chassis Management Module (CVE-2016-0787)

Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerability in libssh2. Vulnerability Details Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerability in libssh2. Vulnerability Details CVE-ID: CVE-2016-0787 Description:...

Security Bulletin: Vulnerability in libssh2 affect IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru Firmware and QLogic Virtual Fabric Extension Module for IBM BladeCenter (CVE-2016-0787)

Summary Vulnerability in libssh2 affects IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru Firmware and QLogic Virtual Fabric Extension Module for IBM BladeCenter. Vulnerability Details Summary Vulnerability in libssh2 affects IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru Firmware and...

Weak Diffie-Hellman Handshake Due To Truncated Secret Length

libssh2 is vulnerable to weak handshakes. The vulnerability happens because diffiehellmansha256 function in kex.c in libssh2 generates secret key of length 128 or 256 bits instead of 1023 or 2047 bits, allowing the attackers to intercept or decrypt SSH sessions using bits/bytes confusion bug...

PT-2018-2668

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description The issue is related to an out of bounds read flaw in the way SSH packets are parsed, specifically when the padding length value is greater than the packet length. This could allow a remote attacker...

PT-2018-2669

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description The issue is related to an integer overflow flaw in the way SSH MSG CHANNEL REQUEST packets with an exit signal are parsed. This could lead to an out of bounds write, allowing a remote attacker who...

PT-2018-3005

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description The issue is related to an integer overflow in the libssh2 library, which can be exploited by a remote attacker to execute arbitrary code on the client system when a user connects to a compromised SS...

PT-2018-3091

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description The issue is related to an out of bounds read flaw in the libssh2 packet require and libssh2 packet requirev functions of the libssh2 library. This flaw can be exploited by a remote attacker who...

PT-2018-3089

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description An out of bounds read flaw was discovered in the way SSH MSG CHANNEL REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able ...

PT-2018-3092

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of...

PT-2018-3093

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description The issue is related to an integer overflow in the libssh2 library, specifically in the way keyboard prompt requests are parsed. This could allow a remote attacker who compromises an SSH server to...

PT-2018-3090

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description An out of bounds read flaw was discovered in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data ...

Security Bulletin: A vulnerability in libssh2 affects PowerKVM (CVE-2016-0787)

Summary PowerKVM is affected by a vulnerability in libssh2. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2016-0787 DESCRIPTION: libssh2 could provide weaker than expected security, caused by a type confusion error during the SSHv2 handshake resulting in the generation of a...

Security Bulletin: Vulnerability in libssh2 affects PowerKVM (CVE-2015-1782)

Summary A vulnerability in libssh2 CVE-2015-1782 affects PowerKVM. Vulnerability Details CVEID: CVE-2015-1782 DESCRIPTION: libssh2 is vulnerable to a denial of service, caused by an error in kexagreemethods function. By sending a specially-craftedlity to cause the system to stop responding...

Security Bulletin: IBM Security Access Manager for Mobile is affected by a vulnerability in libssh2 (CVE-2016-0787)

Summary A vulnerability in libssh2 affects IBM Security Access Manager for Mobile. Vulnerability Details CVEID: CVE-2016-0787 DESCRIPTION: libssh2 could provide weaker than expected security, caused by a type confusion error during the SSHv2 handshake resulting in the generation of a reduced amou...