Threats Tagged 'cve-2026-66035'

This update for libssh2_org fixes the following issues: - CVE-2025-15661: out-of-bounds heap read vulnerability in the `sftp_symlink()` function in `src/sftp.c` (bsc#1268546). - CVE-2026-7598: integer overflow in function `userauth_password` of file `src/userauth.c` (bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568). - CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567). - CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737). - CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736). - CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735). - CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).

These are all security issues fixed in the libssh2-1-1.11.1-4.1 package on the GA media of openSUSE Tumbleweed.

A heap buffer overflow vulnerability (CVE-2026-66035) exists in libssh2, affecting Red Hat Hardened Images RPMs. A malicious SSH server can exploit this flaw during the Encrypt-then-MAC cipher negotiation to corrupt heap memory on the client side before authentication. This may lead to arbitrary code execution on the client. Exploitation requires the client to connect to a malicious server, limiting the attack surface. Red Hat has issued an advisory describing the issue and recommending restricting SSH client connections to trusted servers. No official fix has been released yet for the affected Red Hat Hardened Images packages.