CVE-2015-3146: Null Pointer Dereference
Published Apr 13, 2016
·Updated
The (1) SSHMSGNEWKEYS and (2) SSHMSGKEXDHREPLY packet handlers in packagecb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.
Affected Software
8 affected components
libssh libssh<=0.6.4
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Fedoraproject Fedora=21
Fedoraproject Fedora=22
Event History
Apr 13, 2016
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3146?
CVE-2015-3146 is categorized as a denial of service vulnerability due to a NULL pointer dereference.
2
How do I fix CVE-2015-3146?
To fix CVE-2015-3146, update libssh to version 0.6.5 or later.
3
Which versions of libssh are affected by CVE-2015-3146?
Libssh versions prior to 0.6.5, including all versions up to and including 0.6.4, are affected.
4
What operating systems are impacted by CVE-2015-3146?
CVE-2015-3146 affects various Linux distributions including Ubuntu, Debian, and Fedora.
5
Can CVE-2015-3146 be exploited remotely?
Yes, CVE-2015-3146 can be exploited remotely by sending crafted SSH packets.