CVE-2019-3855

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2019
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-38568.8An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requCVE-2019-38578.8An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUESCVE-2019-38589.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remoteCVE-2019-38599.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A rCVE-2019-38609.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker CVE-2019-38619.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packetCVE-2019-38629.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message andCVE-2019-38638.8A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactivCVE-2019-38648.8A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameteCVE-2019-38656.1A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able CVE-2019-38665.5An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were mCVE-2019-38674.1A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access t