CVE-2003-0826
NoneCVSS
—
EPSS
12.1%
Published
Oct 6, 2003
CISA due date
—
The record
lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | lsh-utils | 0 | 1.4.2-6 |
| Debian:12 | lsh-utils | 0 | 1.4.2-6 |
| Debian:3.0 | lsh-utils | 0 | 1.2.5-2woody3 |