Advisories ยป MGASA-2019-0139

Updated libssh2 packages fix security vulnerability

Publication date: 10 Apr 2019
Modification date: 10 Apr 2019
Type: security
Affected Mageia releases : 6
CVE: CVE-2019-3855 , CVE-2019-3856 , CVE-2019-3857 , CVE-2019-3858 , CVE-2019-3859 , CVE-2019-3860 , CVE-2019-3861 , CVE-2019-3862 , CVE-2019-3863

Description

Possible integer overflow in transport read allows out-of-bounds write.
(CVE-2019-3855)

Possible integer overflow in keyboard interactive handling allows
out-of-bounds write. (CVE-2019-3856)

Possible integer overflow leading to zero-byte allocation and
out-of-bounds write. (CVE-2019-3857)

Possible zero-byte allocation leading to an out-of-bounds read.
(CVE-2019-3858)

Out-of-bounds reads with specially crafted payloads due to unchecked use
of `_libssh2_packet_require` and `_libssh2_packet_requirev`.
(CVE-2019-3859)

Out-of-bounds reads with specially crafted SFTP packets. (CVE-2019-3860)

Out-of-bounds reads with specially crafted SSH packets. (CVE-2019-3861)

Out-of-bounds memory comparison. (CVE-2019-3862)

Integer overflow in user authenicate keyboard interactive allows
out-of-bounds writes. (CVE-2019-3863)

References

SRPMS

6/core