HackerTrans
TopNewTrendsCommentsPastAskShowJobs

wildylion

no profile record

Submissions

CVE-2026-55200: libssh2 memory corruption with possible RCE

github.com
4 points·by wildylion·11 days ago·1 comments

comments

wildylion
·11 days ago·discuss
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. References

    https://nvd.nist.gov/vuln/detail/CVE-2026-55200
    libssh2/libssh2#2052
    libssh2/libssh2@97acf3d
    https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c
    https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc
    https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc
wildylion
·15 days ago·discuss
Who could've thought that injecting SF6 into blood vessels is actually safe enough to be FDA-approved... interesting.
wildylion
·2 months ago·discuss
You can say whatever, but I'll be calling this a 'slop-down menu' from now on.
wildylion
·2 months ago·discuss
.ru [had this](https://habr.com/ru/news/790214/) in 2024. On the other hand, the russian government in itself had been doing a stellar job at breaking the internet.

(I hope I'll live to see them all sentenced to life without parole)
wildylion
·3 months ago·discuss
Storm troopers, but not the kind you'd expect.
wildylion
·3 months ago·discuss
Only if it's Australia.
wildylion
·4 months ago·discuss
Try to get a middle hop somewhere at a russian datacenter. Sometimes these have DPI censorship boxes disabled (?) -- I know one that lets me forward simple Wireguard from mobile routers to a EU server with a few SNAT/DNAT rules, even though ordinarily that would get blocked at first sight.

(Sadly, it's just Mikrotik gear that can't use any fancy censorship evasion protocols).
wildylion
·4 months ago·discuss
That'll eventually get detected and put a massive target on the back of anybody dumb enough to use it. Sorry to burst your bubble.
wildylion
·4 months ago·discuss
This is the literal job of state security. Besides, most of those $#@$###s get in not by pretending they've been persecuted, but simply because they already have deep cover and hold passports of other countries.

And I sincerely hope that you will never have to know what it's like to flee your own country, first hand. Peace.
wildylion
·4 months ago·discuss
Fuck you. I have many people here (many of them queer) who had to leave everything and become forced emigres or asylum seekers.

Have a bit of compassion, would ya?

My childhood crush is in Ukraine (I mean, he's Ukrainian), my dear friend (Ukrainian) had to leave everything and seek refuge in NL. My friends (Russian) are under a constant threat of getting imprisoned for 10+ years because they still help support queer and trans people in Russia.

Compared to them I feel very privileged, because I was able to GTFO on my own. But if you think that all Russian citizens must be deported, you're either a troll or a madman. Besides, this is exactly what, for example, Stalin did to Chechens, or think about what the USA did to the Japanese.

Did it help someone? No. Did it ruin millions of lives? You fucking guess.

upd: made it all clearer, and sorry for all the profanity
wildylion
·4 months ago·discuss
I'm considering even creating a dial-up (yes, V.34 modem!) line somewhere near to Russia, to offer a side channel with text browsing, news, IRC and email. For when things get really, really bad (they will ...)

Before you ask: yes, dialup works on modern networks if the codec is G.711 (uncompressed). Most public phone network is this way because fax is a thing, but some bulk carriers or some enterprises use compressed codecs.
wildylion
·4 months ago·discuss
Side question, but what happens if there's a technical error with the service provider that leads to double spending?

Example: we bought tickets worth 300 EUR from Deutsche Bahn, they were hit by a DDoS and couldn't complete the transaction.

We got charged *twice* (i.e. 600 EUR and not refunded yet. AND no tickets!!!

Now they claim all they can do is to give us 600 EUR in vouchers (that are not even transferrable).

Would a Chargeback work in this case?

And my friend (who's ordered the tickets) has a very traditional bank that only gives a statement monthly, and probably accepts claims on every 29 of February, between 7 and 8 AM and only by fax (IYKYK those German companies...)
wildylion
·5 months ago·discuss
> and send them electric impulses in their sleep. So, it's like Lovense, but for dreams?

Sorry, I know it's horrible, but I couldn't resist.
wildylion
·5 months ago·discuss
There actually should be a push for an EU-wide legislation banning this kind of silent, precise location data collection. If anything, Germany is obsessed with Datenschutz but in many cases it's just laughable security theater.
wildylion
·6 months ago·discuss
Maybe get some Star link if you can... (Cringe worthy because of some musky husky guy, but at least it works for now).
wildylion
·6 months ago·discuss
I'm so afraid that my landlord (a big company) will use ANY excuse to rob me of my deposit when I move out... lol, even though I'm a member of Mieterverein.

The same landlord whose workers outright forgot to install the water heater in the kitchen the day I got the flat, and __painted shut__ the bathroom window. LMAO.

Though I can only second this -- use transparent fiber and be creative in where you route it -- and nobody will be able to tell you did something 'naughty' in your rental.
wildylion
·6 months ago·discuss
Get a dial up line into Europe. Maybe somebody like MiCT could help with setting up a modem pool.

33kbps is enough to get on IRC and spread the news.
wildylion
·6 months ago·discuss
Archive link: https://archive.ph/pTp0A
wildylion
·6 months ago·discuss
Learn from the Ukrainians: to avoid jamming, the Dishy can be buried in a narrow trench so that only the sky is visible and it's not radiating outwards.
wildylion
·7 months ago·discuss
Then why aren't we totally losing it when immersed in incredibly powerful magnetic fields inside an MRI machine? I'm pretty sure, that 1.5-3T field will totally down ANY useful signal.