UbuntuUpdates.org

Package "libssh2-1-dev"

Name: libssh2-1-dev

Description:

SSH2 client-side library (development headers)
Latest version: 1.10.0-3ubuntu0.1
Release: jammy (22.04)
Level: security
Repository: universe
Head package: libssh2
Homepage: https://libssh2.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libssh2-1-dev"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libssh2-1-dev" in Jammy

Repository Area Version
base universe 1.10.0-3
updates universe 1.10.0-3ubuntu0.1

Changelog

Version: 1.10.0-3ubuntu0.1 2026-09-22 10:07:24 UTC

libssh2 (1.10.0-3ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: integer overflow causes heap-based buffer overflow in
    32-bit publickey response parsing
    - debian/patches/CVE-2026-58050.patch: publickey: fix potential
      multiplication overflow in 32-bit `libssh2_publickey_list_fetch()` in
      src/publickey.c.
    - CVE-2026-58050
  * SECURITY UPDATE: use of uninitialized resource during publickey parse
    failure cleanup
    - debian/patches/CVE-2026-58051.patch: publickey: fix potential arbitrary
      free in `libssh2_publickey_list_fetch()` (#2127) in src/publickey.c.
    - CVE-2026-58051
  * SECURITY UPDATE: double-free vulnerability in sftp_open()
    - debian/patches/CVE-2026-66032.patch: Prevent dangling pointer by
      nullifying data (#2180) in src/sftp.c.
    - CVE-2026-66032
  * SECURITY UPDATE: out-of-bounds read and uninitialized resource free in
    publickey response parsing
    - debian/patches/CVE-2026-66034.patch: publickey: fix potential OOB read
      in `libssh2_publickey_list_fetch()` in src/publickey.c.
    - CVE-2026-66034

 -- Hurman Wed, 16 Sep 2026 17:24:15 +0800
CVE-2026-58050 libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attr
CVE-2026-58051 libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse
CVE-2026-66032 libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicio
CVE-2026-66034 libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbit


About   -   Send Feedback to @ubuntu_updates