-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 01 Aug 2026 13:42:11 +0200 Source: libssh Binary: libssh-4 libssh-4-dbgsym libssh-dev Architecture: ppc64el Version: 0.11.5-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) Changed-By: Martin Pitt Description: libssh-4 - tiny C SSH library (OpenSSL flavor) libssh-dev - tiny C SSH library - Development files (OpenSSL flavor) Closes: 1127693 1142537 Changes: libssh (0.11.5-0+deb13u1) trixie-security; urgency=medium . * New upstream security/bug fix release 0.11.4: - CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() - CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files - CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input - CVE-2026-0967: Specially crafted patterns could cause DoS - CVE-2026-0968: OOB Read in sftp_parse_longname() - CVE-2026-3731: Read buffer overrun when handling SFTP extensions - Note: CVE-2025-14821 is Windows specific, does not apply to Linux https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/ (Closes: #1127693) * New upstream security/bug fix release 0.11.5: - CVE-2026-15370: Stack buffer overflow in SFTP server longname construction - CVE-2026-59843: Denial of service via zero advertised channel packet size - CVE-2026-59844: Denial of service via oversized SFTP read length - CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure - CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification - CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs - CVE-2026-59849: Denial of service via automatic certificate authentication loop - CVE-2026-59850: Use-after-free via data callbacks on closed channels - Zero-initialize every ssh_string https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/ (Closes: #1142537) Checksums-Sha1: 800df756f451ad8e5ab114d65f16dbe52013472c 593804 libssh-4-dbgsym_0.11.5-0+deb13u1_ppc64el.deb 79e9a0faf9e0661b4d37e80e10a859fda93a4589 230432 libssh-4_0.11.5-0+deb13u1_ppc64el.deb 600fa7983cb5fb3a91bc70cdb3d8ce6f9f7bbc0f 296704 libssh-dev_0.11.5-0+deb13u1_ppc64el.deb 1694d55386e6aa301e245c642b58ca9fd03b760f 8872 libssh_0.11.5-0+deb13u1_ppc64el-buildd.buildinfo Checksums-Sha256: 5654d57f66206b14cf1f4523b238a6b587f2d6c495981496f497900e6cd2a5f0 593804 libssh-4-dbgsym_0.11.5-0+deb13u1_ppc64el.deb e4304a206e8f81d20dd763cd314aa3d36f66f5cbad11a47a060ac7b195bf2e41 230432 libssh-4_0.11.5-0+deb13u1_ppc64el.deb b850a94aaa8b06d6da7debdff67d1c7dbc4a3ba19e840449da884f33b17e2df7 296704 libssh-dev_0.11.5-0+deb13u1_ppc64el.deb a0d470ca3095fa9539d2be24328f65592c35273777df91b35fcc7c300e5baa45 8872 libssh_0.11.5-0+deb13u1_ppc64el-buildd.buildinfo Files: c237ca0039e17c3f52da7ffa8e7da31d 593804 debug optional libssh-4-dbgsym_0.11.5-0+deb13u1_ppc64el.deb 3c37e881196c9cd1fa2c486279b667da 230432 libs optional libssh-4_0.11.5-0+deb13u1_ppc64el.deb e082ff986b92c5a16d4df19dcc173b17 296704 libdevel optional libssh-dev_0.11.5-0+deb13u1_ppc64el.deb 80fa5ef66a980eae39007d8028266305 8872 libs optional libssh_0.11.5-0+deb13u1_ppc64el-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmpuUAIACgkQV8ucRsMT puPDqA//V+gl5l1yBhbGi3daBYO5tWsGJAufOhTLuYThoqOkqIgtOQhwOewMYvZN hW5Vr+JlN8xXnlBFKF0xvYkVJ7fdRlKDpAogbtVVdRMTU0hTerS+/rQDxQRqoC/w 6LXuuZaX63bzIrAn6XcwRBGql7eKzf+uiJvt2WjjFB0cnsEn/YO5mojxpP0wemam 6/1ED52AO8HDpSAl2OyJSm9aZzDmTaUTep4EpuAJBzrRdWqgUUDi8bh6C+Gn+HVw VmrXt2jvbNLl13P+W8dz5WXnOQhHSJmzda9O3R/JnoSC7I05WDFKyI6xgexGIN6X aeLw7WAkd60TxoW+yvkjIzcvQerevRIwcPc8/+ZRM+xyqSJ0w2s6wZkLxAxmTWdL 4135UPrwmqZxFkR1yOgIS554HBNxiUb1iMpDJ0ekZrpj2fDU3sHj+aO16Ho9q4IJ 0RfkXYVk6wp5R/ST85MM56MA8e/PjvMIuxrWVSypMQidAT61lLS3Hukb015i/1sS gUwErByworL6bHCfF2z/ui6//+yR2pVRT58XHNWGJAPXrBLd6l2czHSN/VfvltPc QfobMdiDdUpYFGCyLJ12sqs1LV6wIaFR1hShn23axl+zC5hxovQQHJis+s8G5rqE WIZzbOX9nBcJ7R4FgnPr+Ltj542HyHbFVedYz3nm9HkR5XM5/x4= =gywW -----END PGP SIGNATURE-----