Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

libssh before 0.5.3 can be crashed or hijacked remotely

CVE-2012-4562 · published 13 years ago
Summary

Versions of the libssh library earlier than 0.5.3 contain calculation mistakes that an attacker can trigger over the network. Exploiting these mistakes can either make the software stop working or allow the attacker to run their own code on the server. Upgrade libssh to version 0.5.3 or newer, or apply any patches provided by your vendor.

What to do
  • Update debian libssh to version 0.5.3-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian libssh < 0.5.3-1
Fix: upgrade to 0.5.3-1
Debian:13 debian libssh < 0.5.3-1
Fix: upgrade to 0.5.3-1
Debian:14 debian libssh < 0.5.3-1
Fix: upgrade to 0.5.3-1
– libssh libssh <= 0.5.2
0.4.7
0.4.8
0.5.0
0.5.1
cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*
Original advisory text
Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which tri...
Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.
References
Severity
7.5 High
Exploitation
13% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published30 Nov 2012
Updated23 Oct 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-4562 · OSV
CVE-2012-4562 · NVD
Track software like this
Free during beta