------------------------------------------------------------------------- Debian LTS Advisory DLA-4773-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias September 05, 2026 https://wiki.debian.org/LTS -------------------------------------------------------------------------
Package : libssh2
Version : 1.10.0-3+deb12u1
CVE ID : CVE-2025-15661 CVE-2026-7598 CVE-2026-58050 CVE-2026-58051
CVE-2026-66032 CVE-2026-66034
Debian Bug : 1140401 1142856 1144415
Multiple security vulnerabilities were discovered in libssh2, a
client-side C library implementing the SSH2 protocol which could result
in memory disclosure, denial of service or potentially the execution of
arbitrary code.
CVE-2025-15661
A malicious server could send an oversized link_len in SSH_FXP_NAME
responses (READLINK/REALPATH) and trigger an out-of-bounds memcpy, leaking
heap memory or crashing the client
CVE-2026-7598
The impacted element is the function userauth_password of the file
src/userauth.c. Such manipulation of the argument
CVE-2026-58050
libsshw2 reads an attacker-controlled 32-bit attribute without bounds
checking, so on 32-bit platforms the multiplication overflows to an
undersized buffer. count from a publickey-subsystem response and uses it
without bounds checking, causing an overflows to an undersized buffer
CVE-2026-58051
libssh2 grows its publickey list with SSH2_REALLOC but does not
zero-initialize new entries before parsing populates them, so a parse
failure reaching the cleanup path leaves. A malicious SSH server offering
the publickey subsystem can use a malformed response to make cleanup free an
uninitialized, attacker-influenceable attrs pointer in a connecting libssh2
client.
CVE-2026-66032
Fix double free in sftp_open() reachable from a malicious server during SFTP
session setup (SSH_FXP_OPEN answered with SSH_FXP_STATUS/FX_OK followed by a
failing sftp_packet_require()) (Closes:
CVE-2026-66034
Fix missing bounds check in libssh2_publickey_list_fetch() leading to a heap
out-of-bounds read and a free of an uninitialized pointer, triggerable by a
malicious server via the publickey subsystem.
For Debian 12 bookworm, these problems have been fixed in version
1.10.0-3+deb12u1.
We recommend that you upgrade your libssh2 packages.
For the detailed security status of libssh2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libssh2
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
signature.asc
Description: PGP signature
