libssh2: information leak
| Package(s): | libssh2 |
CVE #(s): | CVE-2015-1782
|
| Created: | March 11, 2015 |
Updated: | December 22, 2015 |
| Description: |
From the Debian advisory:
Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was
reading and using the SSH_MSG_KEXINIT packet without doing sufficient
range checks when negotiating a new SSH session with a remote server. A
malicious attacker could man in the middle a real server and cause a
client using the libssh2 library to crash (denial of service) or
otherwise read and use unintended memory areas in this process. |
| Alerts: |
|
