Описание
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Список пакетов
Image SLES15-SP6-SAP
Image SLES15-SP6-SAP-BYOS
Image SLES15-SP6-SAP-BYOS-GCE
Image SLES15-SP6-SAP-GCE
Image SLES15-SP6-SAP-Hardened
Image SLES15-SP6-SAP-Hardened-BYOS
Image SLES15-SP6-SAP-Hardened-BYOS-GCE
Image SLES15-SP6-SAP-Hardened-GCE
Image SLES15-SP6-SAPCAL
Image SLES15-SP6-SAPCAL-GCE
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3541-1
- E-Mail link for SUSE-SU-2026:3541-1
- SUSE Security Ratings
- SUSE Bug 1263890
- SUSE Bug 1268546
- SUSE Bug 1269567
- SUSE Bug 1269568
- SUSE Bug 1272734
- SUSE Bug 1272735
- SUSE Bug 1272736
- SUSE Bug 1272737
- SUSE CVE CVE-2025-15661 page
- SUSE CVE CVE-2026-58050 page
- SUSE CVE CVE-2026-58051 page
- SUSE CVE CVE-2026-66032 page
- SUSE CVE CVE-2026-66033 page
- SUSE CVE CVE-2026-66034 page
- SUSE CVE CVE-2026-66035 page
- SUSE CVE CVE-2026-7598 page
Описание
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.
Затронутые продукты
Ссылки
- CVE-2025-15661
- SUSE Bug 1268546
Описание
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.
Затронутые продукты
Ссылки
- CVE-2026-58050
- SUSE Bug 1269568
Описание
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
Затронутые продукты
Ссылки
- CVE-2026-58051
- SUSE Bug 1269567
Описание
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
Затронутые продукты
Ссылки
- CVE-2026-66032
- SUSE Bug 1272737
Описание
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.
Затронутые продукты
Ссылки
- CVE-2026-66033
- SUSE Bug 1272736
Описание
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.
Затронутые продукты
Ссылки
- CVE-2026-66034
- SUSE Bug 1272735
Описание
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.
Затронутые продукты
Ссылки
- CVE-2026-66035
- SUSE Bug 1272734
Описание
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.
Затронутые продукты
Ссылки
- CVE-2026-7598
- SUSE Bug 1263890