CVE-2019-3863

high

Description

A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error.

References

Advisories
More

https://www.debian.org/security/2019/dsa-4431

https://security.netapp.com/advisory/ntap-20190327-0005/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/

https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863

https://access.redhat.com/errata/RHSA-2019:2399

https://access.redhat.com/errata/RHSA-2019:1943

https://access.redhat.com/errata/RHSA-2019:1791

https://access.redhat.com/errata/RHSA-2019:1652

https://access.redhat.com/errata/RHSA-2019:1175

https://access.redhat.com/errata/RHSA-2019:0679

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://www.libssh2.org/CVE-2019-3863.html

https://seclists.org/bugtraq/2019/Apr/25

Details

Source: Mitre, NVD

Published: 2019-03-25

Updated: 2024-11-21

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.09733

	
		OSZAR »