VulnerabilityModified

CVE-2015-1782

The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.

MEDIUM 6.8EPSS 3.50%

Does this matter?

Lower severity and a low EPSS score (3.50%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 3.50% probability · 89th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: debian/debian linux · libssh2/libssh2 · fedoraproject/fedora
Source: secalert@redhat.com

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151943.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152362.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153933.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3182Third Party Advisory
http://www.libssh2.org/adv_20150311.htmlVendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:148Broken Link
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/73061
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151943.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152362.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153933.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3182Third Party Advisory
http://www.libssh2.org/adv_20150311.htmlVendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:148Broken Link
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/73061

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.