libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if sshbuffernew returns NULL.
{ "urgency": "not yet assigned" }