NULL Pointer Dereference in libssh Affects Multiple Distributions
CVE-2020-16135

5.9MEDIUM

Key Information:

Vendor

Libssh

Status
Libssh
Vendor
CVE Published:
29 July 2020

What is CVE-2020-16135?

libssh version 0.9.4 is susceptible to a NULL pointer dereference vulnerability in the tftpserver.c component. This issue occurs when the function ssh_buffer_new returns NULL, leading to potential application crashes or unexpected behavior. Users of libssh should ensure they update to a patched version to mitigate the risks associated with this vulnerability.

References

https://bugs.libssh.org/T232
x_refsource_MISC
https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e682...
x_refsource_MISC
https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.