CVE-2019-3855
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 21, 2019
- Updated
- Oct 14, 2026
- Reserved
- Jan 3, 2019
Description
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.5 High | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
libssh2The libssh2 Project |
|
References
- [oss-security] 20190318 [SECURITY ADVISORIES] libssh2mailing-list
- 20190319 [slackware-security] libssh2 (SSA:2019-077-01)mailing-list
- https://www.libssh2.org/CVE-2019-3855.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855
- http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html
- 107485vdb-entry
- FEDORA-2019-f31c14682fvendor-advisory
- https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767
- [debian-lts-announce] 20190326 [SECURITY] [DLA 1730-1] libssh2 security updatemailing-list
- https://security.netapp.com/advisory/ntap-20190327-0005/
- RHSA-2019:0679vendor-advisory
- openSUSE-SU-2019:1075vendor-advisory
- openSUSE-SU-2019:1109vendor-advisory
- FEDORA-2019-3348cb4934vendor-advisory
- DSA-4431vendor-advisory
- 20190415 [SECURITY] [DSA 4431-1] libssh2 security updatemailing-list
- RHSA-2019:1175vendor-advisory
- RHSA-2019:1652vendor-advisory
- RHSA-2019:1791vendor-advisory
- RHSA-2019:1943vendor-advisory
- FEDORA-2019-9d85600fc7vendor-advisory
- FEDORA-2019-5885663621vendor-advisory
- RHSA-2019:2399vendor-advisory
- https://support.apple.com/kb/HT210609
- 20190927 APPLE-SA-2019-9-26-7 Xcode 11.0mailing-list
- 20190927 APPLE-SA-2019-9-26-7 Xcode 11.0mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.