CVE-2012-4559 Use after free in n/a
Remote attackers can cause denial of service or potentially execute arbitrary code via double free vulnerabilities in libssh.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-4559?
CVE-2012-4559 is a medium-severity use after free vulnerability in n/a, published on 30 Nov 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Weakness: CWE-399
Which versions are affected by CVE-2012-4559?
It affects 1 product.
Products include Libssh Libssh.
How do I fix CVE-2012-4559?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2012-4559 being exploited?
There is no known exploitation of CVE-2012-4559 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2025-5987 Libssh: invalid return code for chacha20 poly1305 with openssl backend
- CVE-2025-14821 Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2012-4560 Memory corruption in n/a
- CVE-2012-4562 Integer overflow in n/a
Sources
Also known as DEBIAN-CVE-2012-4559, GHSA-px93-6r58-rr4j.