-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 01 Aug 2026 13:42:11 +0200 Source: libssh Binary: libssh-4 libssh-4-dbgsym libssh-dev Architecture: armel Version: 0.11.5-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: armel Build Daemon (arm-conova-02) Changed-By: Martin Pitt Description: libssh-4 - tiny C SSH library (OpenSSL flavor) libssh-dev - tiny C SSH library - Development files (OpenSSL flavor) Closes: 1127693 1142537 Changes: libssh (0.11.5-0+deb13u1) trixie-security; urgency=medium . * New upstream security/bug fix release 0.11.4: - CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() - CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files - CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input - CVE-2026-0967: Specially crafted patterns could cause DoS - CVE-2026-0968: OOB Read in sftp_parse_longname() - CVE-2026-3731: Read buffer overrun when handling SFTP extensions - Note: CVE-2025-14821 is Windows specific, does not apply to Linux https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/ (Closes: #1127693) * New upstream security/bug fix release 0.11.5: - CVE-2026-15370: Stack buffer overflow in SFTP server longname construction - CVE-2026-59843: Denial of service via zero advertised channel packet size - CVE-2026-59844: Denial of service via oversized SFTP read length - CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure - CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification - CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs - CVE-2026-59849: Denial of service via automatic certificate authentication loop - CVE-2026-59850: Use-after-free via data callbacks on closed channels - Zero-initialize every ssh_string https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/ (Closes: #1142537) Checksums-Sha1: 36a10f0d1928ea7a71cc5713347726cb49af9300 563972 libssh-4-dbgsym_0.11.5-0+deb13u1_armel.deb 76fca6d091c886839069fe11a04c73dae713697b 179428 libssh-4_0.11.5-0+deb13u1_armel.deb 2d182b7de8b8ebaa77d22c6940541b712221be4e 243268 libssh-dev_0.11.5-0+deb13u1_armel.deb 926d8ea96e9e890d852fc4c8c5ba1116d2824fc9 8719 libssh_0.11.5-0+deb13u1_armel-buildd.buildinfo Checksums-Sha256: 0a4410dd13dfdc59b72e47372245452f0cb636ca5bfb48b0091ab995ba5f5d66 563972 libssh-4-dbgsym_0.11.5-0+deb13u1_armel.deb 51e8f77b8afa171596382fff443fe9efe0aa69e6acf3148fdde0c9ace3bb7185 179428 libssh-4_0.11.5-0+deb13u1_armel.deb 9d6b1d87e02b37c26d53bed54f9bb10eeac8588a69a62fa7373949620bb4ceae 243268 libssh-dev_0.11.5-0+deb13u1_armel.deb b0a10b4343539f3966c1b7861648f2ceb364760c0f1635af5b128eee1b1e8169 8719 libssh_0.11.5-0+deb13u1_armel-buildd.buildinfo Files: 88296f4f73b95dc637f348cba8c5af09 563972 debug optional libssh-4-dbgsym_0.11.5-0+deb13u1_armel.deb 765ddcebdde682d1ff51b7c3e26cdb22 179428 libs optional libssh-4_0.11.5-0+deb13u1_armel.deb 81eb7225aca428b7f5b3898da08dbb28 243268 libdevel optional libssh-dev_0.11.5-0+deb13u1_armel.deb 577e33068fc70a9f84df28b7bc14f14e 8719 libs optional libssh_0.11.5-0+deb13u1_armel-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEa5s+5E+WDkV2pQjwIyDMsRzdi8EFAmpuUA8ACgkQIyDMsRzd i8GJtQ/8CFWb3h+ETXZTOAy7qsWV/lemPusfdiZeXuPrGpopmcq+BBo0M6fLgEqo f38qP3fRjf+MrPlcUUiCz9hAo44SCLR3fDg8bNpATXhOEPLpSmMZS5RpvMU/FK95 om4d75SA8NW3/C91W2oxocmFRChBT9u4iatDcC1z8iDPs7CP7hITnjx1AbCxcmDd 8Iu0z1A1sbNbHKKIzRdOORDZMyIO2wAxP6d8B6GSr1ffICdzaBiFEGqNnweY/sTw DClVllz/x6mUSKKf7j6BzcT6Fa58QIl/lZcJz+MAKe5IN1nn22MjYmYDszCnPVur P32R6FF0PWGb0Zh66/tva4q/CuY9ktFcQPSl+ZUl79moX715f53e0Q64STxaoHSN EUSl/hXU2nLLjKkfYcTqfmt1VXz9dpJ2b8CP7+Y0JZ2LoD9AoOL2x4P318ZEa2JV CePM2ur73xPElRVYranODLhMc1bof4PA30MgHavcIJsObYjg21+dqOC09OWxe/AF 42Dzst0PL4FsAbIEDEg0J/HR6W9WooaNQRoRZrd8Q1TRX7XdeY1S1x4t6Jj7eKRZ SEZ7uoJ6/U4Uko0dtyOmQRFFALEJWQze9jkt61xqwoPSJsmgqHlPod+kf1IGA1Hj HsvQxzjaL78exrEPuipaPK+SeyXnACdrLaBdFr0MtM119sa4dik= =vqrd -----END PGP SIGNATURE-----