CVE-2019-3855 Integer overflow in libssh2

What is CVE-2019-3855?

CVE-2019-3855 is a high-severity vulnerability in Apple Xcode, published on 21 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

Weakness: CWE-787, CWE-190

Which versions are affected by CVE-2019-3855?

It affects 14 products.

Products include Apple Xcode, Debian Debian Linux, Fedoraproject Fedora, Libssh2 Libssh2, Netapp Ontap Select Deploy Administration Utility, Opensuse Leap and 8 more.

How do I fix CVE-2019-3855?

Upgrade to a fixed version.

Is CVE-2019-3855 being exploited?

There is no known exploitation of CVE-2019-3855 in the wild and no public exploit code.

Other vulnerabilities in Apple Xcode

• CVE-2025-48384 Git Link Following Exploited High 8.1
• CVE-2014-9390 JGit Improper Input Validation vulnerability Critical 9.8
• CVE-2019-14379 Deserialization of untrusted data in FasterXML jackson-databind Critical 9.8
• CVE-2018-4164 An issue was discovered in certain Apple products. Critical 9.8
• CVE-2016-0746 Use after free in n/a Critical 9.8

All Apple Xcode vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2019-3855, DEBIAN-CVE-2019-3855, GHSA-hhcg-w86v-64g8, UBUNTU-CVE-2019-3855.