GCVE - cpe:2.3:a:libssh:libssh:0.4.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:libssh:libssh:0.4.8:*:*:*:*:*:*:*

part: a version: 0.4.8 update: *

Vendor	Libssh (`b9844b6c-2be9-56e2-8daa-d03c95a8d908`)
Product	Libssh (`d9aa66f6-4e93-5ad5-b901-72a058f21487`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/mickael9/libssh`	purl2cpe	2026-06-01 10:14:47.395922
`pkg:deb/debian/libssh`	purl2cpe	2026-06-01 10:14:47.395924
`pkg:deb/ubuntu/libssh`	purl2cpe	2026-06-01 10:14:47.395925
`pkg:github/libssh/libssh-mirror`	purl2cpe	2026-06-01 10:14:47.395927
`pkg:github/substack/libssh`	purl2cpe	2026-06-01 10:14:47.395928
`pkg:rpm/centos/libssh`	purl2cpe	2026-06-01 10:14:47.395929
`pkg:rpm/fedora/libssh`	purl2cpe	2026-06-01 10:14:47.395931
`pkg:rpm/opensuse/libssh`	purl2cpe	2026-06-01 10:14:47.395932

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-0017`	vulnerable	2026-06-08 05:05:10.728919	Details available The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision. Published: 2014-03-14T15:00:00.000Z Updated: 2024-08-06T08:58:26.568Z Open on db.gcve.eu Reference links http://www.ubuntu.com/usn/USN-2145-1 http://www.debian.org/security/2014/dsa-2879 http://lists.opensuse.org/opensuse-updates/2014-03/msg00036.html http://secunia.com/advisories/57407 http://www.openwall.com/lists/oss-security/2014/03/05/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0176`	vulnerable	2026-06-08 05:03:45.659554	Details available The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet. Published: 2013-02-05T23:11:00.000Z Updated: 2024-08-06T14:18:09.365Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098094.html https://exchange.xforce.ibmcloud.com/vulnerabilities/81595 http://secunia.com/advisories/51982 http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098065.html http://www.ubuntu.com/usn/USN-1707-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6063`	vulnerable	2026-06-08 05:02:59.082248	Details available Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559. Published: 2012-11-30T22:00:00.000Z Updated: 2024-08-06T21:21:28.545Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=871612 http://www.debian.org/security/2012/dsa-2577 http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/ http://git.libssh.org/projects/libssh.git/commit/?h=v0-5&id=4d8420f3282ed07fc99fc5e930c17df27ef1e9b2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4562`	vulnerable	2026-06-08 05:02:51.512339	Details available Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities. Published: 2012-11-30T22:00:00.000Z Updated: 2024-08-06T20:42:54.563Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00015.html http://www.debian.org/security/2012/dsa-2577 http://www.mandriva.com/security/advisories?name=MDVSA-2012:175 http://www.ubuntu.com/usn/USN-1640-1 http://lists.opensuse.org/opensuse-updates/2013-01/msg00021.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4561`	vulnerable	2026-06-08 05:02:51.511747	Details available The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors. Published: 2012-11-30T22:00:00.000Z Updated: 2024-08-06T20:42:53.678Z Open on db.gcve.eu Reference links http://www.debian.org/security/2012/dsa-2577 http://www.mandriva.com/security/advisories?name=MDVSA-2012:175 https://bugzilla.redhat.com/show_bug.cgi?id=871617 http://www.ubuntu.com/usn/USN-1640-1 http://lists.opensuse.org/opensuse-updates/2013-01/msg00021.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4560`	vulnerable	2026-06-08 05:02:51.511176	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4559`	vulnerable	2026-06-08 05:02:51.508950	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Libssh 0.4.8

Notes

PURL mappings

Vulnerability references

Contribute