CVE catalog

CVE-2025-4877

libssh vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 4.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.20% · Oct 25, 2026

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsshsid0.12.2-1fixed
Debianlibsshforky0.12.2-1fixed
Debianlibsshtrixie0.11.5-0+deb13u1fixed
Debianlibsshtrixie-security0.11.5-0+deb13u1fixed
Debianlibsshbookworm0.10.6-0+deb12u2fixed
Debianlibsshbookworm-security0.10.6-0+deb12u3fixed
Ubuntulibsshnoble0.10.6-0+deb12u2fixed
Ubuntulibsshnoble0.10.6-2ubuntu0.1fixed
Ubuntulibssh-4noble0.10.6-2ubuntu0.1fixed
Ubuntulibssh-devnoble0.10.6-2ubuntu0.1fixed
Ubuntulibssh-docnoble0.10.6-2ubuntu0.1fixed
Ubuntulibssh-gcrypt-4noble0.10.6-2ubuntu0.1fixed
Ubuntulibssh-gcrypt-devnoble0.10.6-2ubuntu0.1fixed
Ubuntulibsshpro0.9.0-1ubuntu1vulnerable
Ubuntulibsshpro0.9.0-1ubuntu4vulnerable
Ubuntulibsshpro0.9.0-1ubuntu5vulnerable
Ubuntulibsshpro0.9.3-2ubuntu1vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.1vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.2vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.3vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.4vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.5vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.5+esm1fixed
Ubuntulibssh22.040.9.6-1vulnerable
Ubuntulibssh22.040.9.6-1build1vulnerable
Ubuntulibssh22.040.9.6-2vulnerable
Ubuntulibssh22.040.9.6-2build1vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.1vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.2vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.3vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.4fixed
Ubuntulibssh24.040.10.5-3ubuntu1vulnerable
Ubuntulibssh24.040.10.5-3ubuntu2vulnerable
Ubuntulibssh24.040.10.6-2vulnerable
Ubuntulibssh24.040.10.6-2build1vulnerable
Ubuntulibssh24.040.10.6-2build2vulnerable
Ubuntulibssh24.040.10.6-2ubuntu0.1fixed
Ubuntulibsshpro0.9.0-1ubuntu1vulnerable
Ubuntulibsshpro0.9.0-1ubuntu4vulnerable
Ubuntulibsshpro0.9.0-1ubuntu5vulnerable
Ubuntulibsshpro0.9.3-2ubuntu1vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.1vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.2vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.3vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.4vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.5vulnerable
Ubuntulibsshpro0.9.3-2ubuntu2.5+esm1fixed
Ubuntulibssh22.040.9.6-1vulnerable
Ubuntulibssh22.040.9.6-1build1vulnerable
Ubuntulibssh22.040.9.6-2vulnerable
Ubuntulibssh22.040.9.6-2build1vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.1vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.2vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.3vulnerable
Ubuntulibssh22.040.9.6-2ubuntu0.22.04.4fixed
Ubuntulibssh24.040.10.5-3ubuntu1vulnerable
Ubuntulibssh24.040.10.5-3ubuntu2vulnerable
Ubuntulibssh24.040.10.6-2vulnerable
Ubuntulibssh24.040.10.6-2build1vulnerable
Ubuntulibssh24.040.10.6-2build2vulnerable
Ubuntulibssh24.040.10.6-2ubuntu0.1fixed
Opensuselibsshtumbleweed0.11.2-1.1fixed
Suselibsshlinux micro 6.10.10.6-slfo.1.1_2.1fixed
Suselibsshlinux enterprise server 12 sp5-ltss0.9.8-3.15.1fixed
Suselibsshlinux enterprise server ltss extended security 12 sp50.9.8-3.15.1fixed
Suselibsshlinux micro 6.00.10.6-2.1fixed
Suselibsshlinux enterprise high performance computing 15 sp3-ltss0.9.8-150200.13.9.1fixed
Suselibsshlinux enterprise server 15 sp3-ltss0.9.8-150200.13.9.1fixed
Suselibsshlinux enterprise server for sap applications 15 sp30.9.8-150200.13.9.1fixed
Suselibsshlinux enterprise micro 5.10.9.8-150200.13.9.1fixed
Suselibsshlinux enterprise micro 5.20.9.8-150200.13.9.1fixed
Suselibsshenterprise storage 7.10.9.8-150200.13.9.1fixed
Suselibsshlinux enterprise module for basesystem 15 sp60.9.8-150600.11.3.1fixed
Suselibsshlinux enterprise module for basesystem 15 sp70.9.8-150600.11.3.1fixed
Opensuselibsshleap 15.60.9.8-150600.11.3.1fixed
Suselibsshlinux enterprise micro 5.30.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise micro 5.40.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise micro 5.50.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise high performance computing 15 sp4-espos0.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise high performance computing 15 sp4-ltss0.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise high performance computing 15 sp5-espos0.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise high performance computing 15 sp5-ltss0.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise server 15 sp4-ltss0.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise server 15 sp5-ltss0.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise server for sap applications 15 sp40.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise server for sap applications 15 sp50.9.8-150400.3.9.1fixed
Suselibsshmanager proxy 4.30.9.8-150400.3.9.1fixed
Suselibsshmanager server 4.30.9.8-150400.3.9.1fixed
Suselibsshlinux enterprise server 12 sp5-ltss0.6.3-12.15.1fixed
Suselibsshlinux enterprise server ltss extended security 12 sp50.6.3-12.15.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsshsourcesid0.11.2-1not yet assignedNot reported[1108407]
Debianlibsshsourceforky0.11.2-1not yet assignedNot reported[1108407]
Debianlibsshsourcetrixie0.11.2-1not yet assignedNot reported[1108407]
Debianlibsshsourcebookworm0.10.6-0+deb12u2not yet assignedNot reported[1108407]
Ubuntulibsshdebnoble0.10.6-0+deb12u2Not reportedNot reportedNot reported
Ubuntulibsshdebnoble0.10.6-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibssh-4debnoble0.10.6-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibssh-devdebnoble0.10.6-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibssh-docdebnoble0.10.6-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibssh-gcrypt-4debnoble0.10.6-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibssh-gcrypt-devdebnoble0.10.6-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibsshdebpro0.9.3-2ubuntu2.5+esm1Not reportedUSN-7696-1Not reported
Ubuntulibsshdeb22.040.9.6-2ubuntu0.22.04.4Not reportedUSN-7619-1Not reported
Ubuntulibsshdeb24.040.10.6-2ubuntu0.1Not reportedUSN-7619-1Not reported
Ubuntulibsshdebpro0.9.3-2ubuntu2.5+esm1Not reportedUBUNTU-CVE-2025-4877Not reported
Ubuntulibsshdeb22.040.9.6-2ubuntu0.22.04.4Not reportedUBUNTU-CVE-2025-4877Not reported
Ubuntulibsshdeb24.040.10.6-2ubuntu0.1Not reportedUBUNTU-CVE-2025-4877Not reported
Opensuselibsshrpmtumbleweed0.11.2-1.1Not reportedOPENSUSE-SU-2025:15243-1Not reported
Suselibsshrpmlinux micro 6.10.10.6-slfo.1.1_2.1Not reportedSUSE-SU-2025:20596-1Not reported
Suselibsshrpmlinux enterprise server 12 sp5-ltss0.9.8-3.15.1Not reportedSUSE-SU-2025:02281-1Not reported
Suselibsshrpmlinux enterprise server ltss extended security 12 sp50.9.8-3.15.1Not reportedSUSE-SU-2025:02281-1Not reported
Suselibsshrpmlinux micro 6.00.10.6-2.1Not reportedSUSE-SU-2025:20557-1Not reported
Suselibsshrpmlinux enterprise high performance computing 15 sp3-ltss0.9.8-150200.13.9.1Not reportedSUSE-SU-2025:02279-1Not reported
Suselibsshrpmlinux enterprise server 15 sp3-ltss0.9.8-150200.13.9.1Not reportedSUSE-SU-2025:02279-1Not reported
Suselibsshrpmlinux enterprise server for sap applications 15 sp30.9.8-150200.13.9.1Not reportedSUSE-SU-2025:02279-1Not reported
Suselibsshrpmlinux enterprise micro 5.10.9.8-150200.13.9.1Not reportedSUSE-SU-2025:02279-1Not reported
Suselibsshrpmlinux enterprise micro 5.20.9.8-150200.13.9.1Not reportedSUSE-SU-2025:02279-1Not reported
Suselibsshrpmenterprise storage 7.10.9.8-150200.13.9.1Not reportedSUSE-SU-2025:02279-1Not reported
Suselibsshrpmlinux enterprise module for basesystem 15 sp60.9.8-150600.11.3.1Not reportedSUSE-SU-2025:02229-1Not reported
Suselibsshrpmlinux enterprise module for basesystem 15 sp70.9.8-150600.11.3.1Not reportedSUSE-SU-2025:02229-1Not reported
Opensuselibsshrpmleap 15.60.9.8-150600.11.3.1Not reportedSUSE-SU-2025:02229-1Not reported
Suselibsshrpmlinux enterprise micro 5.30.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise micro 5.40.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise micro 5.50.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise high performance computing 15 sp4-espos0.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise high performance computing 15 sp4-ltss0.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise high performance computing 15 sp5-espos0.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise high performance computing 15 sp5-ltss0.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise server 15 sp4-ltss0.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise server 15 sp5-ltss0.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise server for sap applications 15 sp40.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise server for sap applications 15 sp50.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmmanager proxy 4.30.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmmanager server 4.30.9.8-150400.3.9.1Not reportedSUSE-SU-2025:02278-1Not reported
Suselibsshrpmlinux enterprise server 12 sp5-ltss0.6.3-12.15.1Not reportedSUSE-SU-2025:02755-1Not reported
Suselibsshrpmlinux enterprise server ltss extended security 12 sp50.6.3-12.15.1Not reportedSUSE-SU-2025:02755-1Not reported

[Debian bug #1108407]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libssh-4]Affected

    Source package: [libssh]

    Details (4)
    • 0.10.6-0+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

  • [libssh-dev]Affected

    Source package: [libssh]

    Details (4)
    • 0.10.6-0+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

  • [libssh-doc]Affected

    Source package: [libssh]

    Details (4)
    • 0.10.6-0+deb12u2 · all · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u2 · all · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · all · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · all · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

  • [libssh-gcrypt-4]Affected

    Source package: [libssh]

    Details (4)
    • 0.10.6-0+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

  • Source package: [libssh]

    Details (4)
    • 0.10.6-0+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

    • 0.10.6-0+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 0.10.6-0+deb12u2

      usn · libssh · debian · bookworm; usn · libssh · debian · 12

[openSUSE Tumbleweed]

  • [libssh4]Unknown

    Source package: [libssh]

    Details (1)
    • 0.11.5-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.11.2-1.1

      Version impact unknown

      usn · libssh · opensuse · tumbleweed

  • [libssh4-32bit]Unknown

    Source package: [libssh]

    Details (1)
    • 0.11.5-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.11.2-1.1

      Version impact unknown

      usn · libssh · opensuse · tumbleweed

  • [libssh-config]Unknown

    Source package: [libssh]

    Details (1)
    • 0.11.5-2.1 · noarch · tumbleweed

      Unknown · Fixed: 0.11.2-1.1

      Version impact unknown

      usn · libssh · opensuse · tumbleweed

  • [libssh-devel]Unknown

    Source package: [libssh]

    Details (1)
    • 0.11.5-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.11.2-1.1

      Version impact unknown

      usn · libssh · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [libssh-4]Fixed

    Source package: [libssh]

    Details (4)
    • 0.11.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.5-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.5-0+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

  • [libssh-dev]Fixed

    Source package: [libssh]

    Details (4)
    • 0.11.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.5-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.5-0+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

  • [libssh-doc]Fixed

    Source package: [libssh]

    Details (4)
    • 0.11.2-1+deb13u1 · all · trixie

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.2-1+deb13u1 · all · trixie

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.5-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

    • 0.11.5-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 0.11.2-1

      usn · libssh · debian · 13

Observed:

References