Integer overflow flaw in libssh2 identified

Impact of the flaw in libssh2

The Common Vulnerability Scoring System (CVSS) base score, a numerical score that reflects its severity, calculated by the team who identified the flaw is 8.8, which is high. The overall impact score calculated by the team is 5.9 where the exploitability score is 2.8. The team also identified that the attack vector was a network and the attack complexity was low.

Security issues fixed by the team

CVE-2019-3861: The team fixed out-of-bounds reads with SSH packets.

CVE-2019-3862: The team fixed the issues related to out-of-bounds memory with message channel request packet.

CVE-2019-3860: The team fixed out-of-bounds reads with SFTP packets.

CVE-2019-3863: The team fixed the integer overflow in user authenticate keyboard which could allow out-of-bounds writes with keyboard responses.

CVE-2019-3856: The team fixed the issues related to a potential integer overflow in keyboard handling which could allow out-of-bounds write with payload.

CVE-2019-3859: The team fixed the issues with out-of-bounds reads with payloads because of unchecked use of _libssh2_packet_require and _libssh2_packet_requirev.

CVE-2019-3855: The team fixed a potential Integer overflow in transport read which could allow out-of-bounds write with a payload.

CVE-2019-3858: The issues with the zero-byte allocation have been fixed, which could lead to an out-of-bounds read with SFTP packet.

To know more about this news, check out NVD’s post.

Linux use-after-free vulnerability found in Linux 2.6 through 4.20.11

Stable release of CUDA 10.0 out, with Turing support, tools and library changes

‘Peekaboo’ Zero-Day Vulnerability allows hackers to access CCTV cameras, says Tenable Research