CVE-2026-15370

Publié : 21 juillet 2026

Modifié : 21 juillet 2026

Score CVSS

6.7

MEDIUM

Description détaillée

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Références et Patchs

https://access.redhat.com/security/cve/CVE-2026-15370 https://bugzilla.redhat.com/show_bug.cgi?id=2499049

Dernières Vulnérabilités

CVE-2026-8285

Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 through 11052026.

VOIR DÉTAILS

CVE-2026-8284

URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCity allows Input Data Manipulation. This issue affects FlexCity: from 5.536.0 through 11052026.

VOIR DÉTAILS

CVE-2026-6792

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 through 11052026.

VOIR DÉTAILS