CVE-2013-0176 Null dereference in n/a
Remote attackers can crash libssh applications via a crafted Diffie-Hellman Key Exchange Init packet due to a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0176?
CVE-2013-0176 is a medium-severity vulnerability in n/a, published on 5 Feb 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet.
Weakness: CWE-399
Which versions are affected by CVE-2013-0176?
It affects 1 product.
Products include Libssh Libssh.
How do I fix CVE-2013-0176?
Upgrade to a fixed version.
Is CVE-2013-0176 being exploited?
There is no known exploitation of CVE-2013-0176 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2025-5987 Libssh: invalid return code for chacha20 poly1305 with openssl backend
- CVE-2025-14821 Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2012-4560 Memory corruption in n/a
- CVE-2012-4562 Integer overflow in n/a
Sources
Also known as DEBIAN-CVE-2013-0176, GHSA-mwpj-rq8j-724c.