CVE-2014-8132: Canonical Ubuntu Linux

Medium severity, CVSS 5.0. EPSS: 5.1% chance of exploitation in the next 30 days.

Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 14.10 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• Fedoraproject Fedora: version 19 only; version 20 only; version 21 only
• Libssh Libssh: version 0.5.0 only; version 0.5.2 only; version 0.5.3 only; version 0.5.4 only; version 0.5.5 only; version 0.6.0 only; …
• Opensuse Opensuse: version 12.3 only; version 13.1 only; version 13.2 only

Published 2014-12-29. Last modified 2026-06-17.