High · published March 25, 2019
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
| Product | Versions | Fixed in |
|---|---|---|
| libssh2/libssh2 | ≥ 1.2.8, ≤ 1.8.0 | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| opensuse/leap | all versions | — |
| opensuse/leap | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_eus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| fedoraproject/fedora | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |