CVE-2015-1782
Fixed in a distro release EPSS 4%
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
Products: debian_linux, libssh2, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libssh2 | 1.4.3-4.1 |
| Debian 13 | libssh2 | 1.4.3-4.1 |
| Debian 14 | libssh2 | 1.4.3-4.1 |
| Debian 6.0 | libssh2 | 1.2.6-1+deb6u1 |
| Debian 7 | libssh2 | 1.4.2-1.1+deb7u1 |
| Red Hat Enterprise Linux 7 | libssh2 | 0:1.4.3-10.el7 |
| Red Hat Enterprise Linux 7 | libssh2-debuginfo | 0:1.4.3-10.el7 |
| Red Hat Enterprise Linux 7 | libssh2-devel | 0:1.4.3-10.el7 |
| Red Hat Enterprise Linux 7 | libssh2-docs | 0:1.4.3-10.el7 |
| SUSE Linux Enterprise Desktop 12 | libssh2_org | 1.4.3-11.1 |
| SUSE Linux Enterprise Server 12 | libssh2_org | 1.4.3-11.1 |
| SUSE Linux Enterprise Server 12 SP5 | libssh2_org | 1.11.0-29.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libssh2_org | 1.4.3-11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | libssh2_org | 1.11.0-29.6.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libssh2_org | 1.4.3-11.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | libssh2_org | 1.11.0-29.6.1 |
| Ubuntu 14.04 LTS | libssh2 | 1.4.3-2ubuntu0.2 |
| openSUSE Tumbleweed | libssh2_org | 1.7.0-1.5 |