CVE-2015-3146

HIGH

libssh < 0.6.5 - Denial of Service via Crafted SSH Packet

Title source: llm

Description

The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.

References (7)

Core 7

Core References

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2912-1

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161802.html

Vendor Advisory x_refsource_confirm

https://www.libssh.org/security/advisories/CVE-2015-3146.txt

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158013.html

Vendor Advisory x_refsource_confirm

https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3488

Patch x_refsource_confirm

https://git.libssh.org/projects/libssh.git/commit/?h=libssh-0.6.5&id=94f6955fbaee6fda9385a23e505497efe21f5b4f

Scores

CVSS v3 7.5

EPSS 0.0391

EPSS Percentile 89.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published

Products (8)

canonical/ubuntu_linux 12.04

canonical/ubuntu_linux 14.04

canonical/ubuntu_linux 15.10

debian/debian_linux 7.0

debian/debian_linux 8.0

fedoraproject/fedora 21

fedoraproject/fedora 22

libssh/libssh < 0.6.4

Published Apr 13, 2016

Tracked Since Feb 18, 2026