-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 01 Aug 2026 13:42:11 +0200 Source: libssh Binary: libssh-4 libssh-4-dbgsym libssh-dev Architecture: riscv64 Version: 0.11.5-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: riscv64 Build Daemon (rv-osuosl-03) Changed-By: Martin Pitt Description: libssh-4 - tiny C SSH library (OpenSSL flavor) libssh-dev - tiny C SSH library - Development files (OpenSSL flavor) Closes: 1127693 1142537 Changes: libssh (0.11.5-0+deb13u1) trixie-security; urgency=medium . * New upstream security/bug fix release 0.11.4: - CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() - CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files - CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input - CVE-2026-0967: Specially crafted patterns could cause DoS - CVE-2026-0968: OOB Read in sftp_parse_longname() - CVE-2026-3731: Read buffer overrun when handling SFTP extensions - Note: CVE-2025-14821 is Windows specific, does not apply to Linux https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/ (Closes: #1127693) * New upstream security/bug fix release 0.11.5: - CVE-2026-15370: Stack buffer overflow in SFTP server longname construction - CVE-2026-59843: Denial of service via zero advertised channel packet size - CVE-2026-59844: Denial of service via oversized SFTP read length - CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure - CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification - CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs - CVE-2026-59849: Denial of service via automatic certificate authentication loop - CVE-2026-59850: Use-after-free via data callbacks on closed channels - Zero-initialize every ssh_string https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/ (Closes: #1142537) Checksums-Sha1: 84f64e776320c0104d895d58982dd261482dbce5 559092 libssh-4-dbgsym_0.11.5-0+deb13u1_riscv64.deb c2a86c652ed63d2860c699477bb01e3de287bd8e 217356 libssh-4_0.11.5-0+deb13u1_riscv64.deb 65176e9d3840a97bf1d5b15f6c58b2699a49f742 574300 libssh-dev_0.11.5-0+deb13u1_riscv64.deb f99cf33881c6bd9ff57444671253be4315a81989 8843 libssh_0.11.5-0+deb13u1_riscv64-buildd.buildinfo Checksums-Sha256: 914585dcc9168bfcc0ea4011d06f7462e5f4e806733f400592a7c0cd547239a5 559092 libssh-4-dbgsym_0.11.5-0+deb13u1_riscv64.deb 0270c6596e5f53077db87dae265a7df3807d3955fc5e6604e96a91418f3f16b0 217356 libssh-4_0.11.5-0+deb13u1_riscv64.deb 348ddeaf19d88d2ffecf7cad55bca7cf7d8905577df1ee93989b088de8d63f0d 574300 libssh-dev_0.11.5-0+deb13u1_riscv64.deb d89bb8820a75c8d54430d62b59ea47f15d586f353806589859183866eaedbd5d 8843 libssh_0.11.5-0+deb13u1_riscv64-buildd.buildinfo Files: 048958b9c8bb2928a4f06f1fee11d3d8 559092 debug optional libssh-4-dbgsym_0.11.5-0+deb13u1_riscv64.deb c4c07c066b97ee38a63045ab12476b38 217356 libs optional libssh-4_0.11.5-0+deb13u1_riscv64.deb 513e5dae0acddba5caac73090511081c 574300 libdevel optional libssh-dev_0.11.5-0+deb13u1_riscv64.deb 17620c0e15f43332d87b6f015dd60ba3 8843 libs optional libssh_0.11.5-0+deb13u1_riscv64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEExv8RwtKAmv8J56r/6ETk30hvxtkFAmpuVHUACgkQ6ETk30hv xtkA6g/9GlHldTmN6H9ZY5HZYwjcmymRkOnrEVKeJMBaBpogCiOi+I2ssgp/hiOM Wwd9hzMjIPqIjcK78U9YGA9YzKXosICIK44v42tnkw+IclvB6PFFE9RFLzdQdHzc qCu3RFVN23ZtPz3jVLtE1zXiVEKSWomqHBleua3dV88jPAHgjzHf4gnDUgAnsDac OJJzzQscEV6VsiDQi2jo4s+zqjX5IQ+vpP5ZYQs5+zwiqTy20c8mBG4+UUXUkMMm sYLglyhbi0bAAWnwdwaR5Vz9xWNk2En4W1zTS3H0KieLKsiQ8IGgfuhEL2TeKDwm 8DnZ+IEq2ZDrti0Pqoytv4eJxmojHcEuFTWA/0h0p78ywlQDkmBNfBR8/NDwXGFh 4loWKHSe2C9yzIboYRF7ph2bA/cGjQgw0lOHn+RixcuC3by3uWJAPkrqCT2QixaS /RXRNfCDxeiKwkYfdrrHXGLmn3Ei/7lo3qWrQw2MIb1YR66MOUkzcNpo/JNX1LMw 8k3JVf2HrorGSHe+AQzPApL9OpDH2o9zgYEYzY6WbPpD2GgnqfPovGp85GL8j6Vw c5t3y8+dfV5+GlDfM4/Ovjau4t1frUdJEnDC6WaQrcJUawDizo7htv22nThCB+fS VbtlA9rEGC7a3vri+i29W3VVBp8zE2tulrBtN8T74OSaXwlD+uw= =WKMa -----END PGP SIGNATURE-----