Stay Secure with the Latest Linux Advisories

security advisorydenial of servicedebian

Debian LTS DLA-1991-1: Libssh2 Critical Integer Overflow Risk

In libssh2, SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A . Package : libssh2 Version : 1.4.3-4.1+deb8u6 CVE ID : CVE-2019-17498 Debian Bug : 943562 In libssh2, SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server For Debian 8 "Jessie", this problem has been fixed in version 1.4.3-4.1+deb8u6. We recommend that you upgrade your libssh2 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . A buffer overflow flaw in OpenSSL could lead to unauthorized access or system crashes in server installations.. libssh2 Security Update, Debian LTS Advisory, Integer Overflow, Memory Leak, Denial of Service. . Severity: Critical. LinuxSecurity.com Team

Nov 13, 2019 •Critical Debian LTS