CVE-2020-16135
Publication date 29 July 2020
Last updated 25 August 2025
Ubuntu priority
Description
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libssh | 20.04 LTS focal |
Fixed 0.9.3-2ubuntu2.1
|
| 18.04 LTS bionic |
Fixed 0.8.0~20170825.94fa1e38-1ubuntu0.7
|
|
| 16.04 LTS xenial |
Fixed 0.6.3-4.3ubuntu0.6
|
|
| 14.04 LTS trusty | Not in release |
Patch details
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.9 · Medium
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-4447-1
- libssh vulnerability
- 4 August 2020
Other references
- https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238
- https://bugs.libssh.org/T232
- https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120
- https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=1493b4466fa394b321d196ad63dd6a4fa395d337
- https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=dbfb7f44aa905a7103bdde9a198c1e9b0f480c2e
- https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=65ae496222018221080dd753a52f6d70bf3ca5f3
- https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=df0acab3a077bd8ae015e3e8b4c71ff31b5900fe
- https://www.cve.org/CVERecord?id=CVE-2020-16135