Published: 29/12/2014 Updated: 30/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x prior to 0.6.4 allows remote malicious users to cause a denial of service via a crafted kexinit packet.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libssh libssh 0.6.0
libssh libssh 0.6.1
libssh libssh 0.5.4
libssh libssh 0.5.5
libssh libssh 0.5.0
libssh libssh 0.6.2
libssh libssh 0.6.3
libssh libssh 0.5.2
libssh libssh 0.5.3
debian debian linux 7.0
debian debian linux 8.0
opensuse opensuse 13.1
opensuse opensuse 12.3
opensuse opensuse 13.2
fedoraproject fedora 19
fedoraproject fedora 20
fedoraproject fedora 21
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04

libssh could be made to crash if it received specially crafted network traffic ...

Debian Bug report logs - #784404 libssh: CVE-2015-3146: null pointer dereference due to a logical error in the handling of a SSH_MSG_NEWKEYS and KEXDH_REPLY packets Package: src:libssh; Maintainer for src:libssh is Laurent Bigonville <bigon@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, ...

Debian Bug report logs - #773577 libssh: CVE-2014-8132: Double free on dangling pointers in initial key exchange packet Package: src:libssh; Maintainer for src:libssh is Laurent Bigonville <bigon@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 Dec 2014 07:21:02 UTC Severity: important ...

Aris Adamantiadis discovered that libssh, a tiny C SSH library, incorrectly generated a short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits respectively This flaw could allow an eavesdropper with enough re ...

NVD-CWE-Other https://bugzilla.redhat.com/show_bug.cgi?id=1158089 http://www.libssh.org/2014/12/19/libssh-0-6-4-security-and-bugfix-release/http://www.ubuntu.com/usn/USN-2478-1 http://www.mandriva.com/security/advisories?name=MDVSA-2015:020 http://advisories.mageia.org/MGASA-2015-0014.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147367.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147452.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147464.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00007.html http://www.debian.org/security/2016/dsa-3488 https://security.gentoo.org/glsa/201606-12 http://secunia.com/advisories/60838 https://usn.ubuntu.com/2478-1/https://nvd.nist.gov

CVE-2014-8132

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect