CVE-2019-3855

Опубликовано: 21 мар. 2019

Источник: nvd

CVSS3: 7.5

CVSS3: 8.8

CVSS2: 9.3

EPSS Средний

Описание

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html
Third Party Advisory
http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Sep/42
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/03/18/3
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/107485
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:0679
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1175
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1652
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1791
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1943
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2399
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/
https://seclists.org/bugtraq/2019/Apr/25
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Mar/25
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*

Версия до 1.8.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 6

cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

Конфигурация 7

cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*

Версия до 11.0 (исключая)

Конфигурация 8

Одно из

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.12496

Средний

7.5 High

CVSS3

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-190

Связанные уязвимости

CVE-2019-3855

CVSS3: 8.8

ubuntu

около 6 лет назад

CVE-2019-3855

CVSS3: 7.5

redhat

больше 6 лет назад

CVE-2019-3855

CVSS3: 8.8

debian

около 6 лет назад

An integer overflow flaw which could lead to an out of bounds write wa ...

GHSA-hhcg-w86v-64g8

CVSS3: 8.8

github

около 3 лет назад

BDU:2019-03898

CVSS3: 8.8

fstec

больше 6 лет назад

Уязвимость библиотеки libssh2, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 94%

0.12496

Средний

7.5 High

CVSS3

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-190