CVE-2010-4755: Freebsd

Medium severity, CVSS 4.0. EPSS: 7.8% chance of exploitation in the next 30 days.

The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.

Affected products

• Freebsd Freebsd: version 7.3 only; version 8.1 only
• Netbsd Netbsd: version 5.0.2 only
• OpenBSD OpenBSD: version 4.7 only
• OpenBSD OpenSSH: up to and including 5.8; version 1.2 only; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.27 only; …

Published 2011-03-02. Last modified 2026-06-16.