-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 01 Aug 2026 13:42:11 +0200 Source: libssh Binary: libssh-4 libssh-4-dbgsym libssh-dev Architecture: amd64 Version: 0.11.5-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Martin Pitt Description: libssh-4 - tiny C SSH library (OpenSSL flavor) libssh-dev - tiny C SSH library - Development files (OpenSSL flavor) Closes: 1127693 1142537 Changes: libssh (0.11.5-0+deb13u1) trixie-security; urgency=medium . * New upstream security/bug fix release 0.11.4: - CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() - CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files - CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input - CVE-2026-0967: Specially crafted patterns could cause DoS - CVE-2026-0968: OOB Read in sftp_parse_longname() - CVE-2026-3731: Read buffer overrun when handling SFTP extensions - Note: CVE-2025-14821 is Windows specific, does not apply to Linux https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/ (Closes: #1127693) * New upstream security/bug fix release 0.11.5: - CVE-2026-15370: Stack buffer overflow in SFTP server longname construction - CVE-2026-59843: Denial of service via zero advertised channel packet size - CVE-2026-59844: Denial of service via oversized SFTP read length - CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure - CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification - CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs - CVE-2026-59849: Denial of service via automatic certificate authentication loop - CVE-2026-59850: Use-after-free via data callbacks on closed channels - Zero-initialize every ssh_string https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/ (Closes: #1142537) Checksums-Sha1: 3cfce712f1f4d5cc73082d3dc874e4abff7a17c7 570992 libssh-4-dbgsym_0.11.5-0+deb13u1_amd64.deb c281a5c8dc2a807fcfadcafc4ea96212708496ab 211924 libssh-4_0.11.5-0+deb13u1_amd64.deb e14110f85175695b28c1119b2a1b99f17f68d78d 268564 libssh-dev_0.11.5-0+deb13u1_amd64.deb 5607eaa542088ba5ccc1fd6f496e05b60ef8066d 8867 libssh_0.11.5-0+deb13u1_amd64-buildd.buildinfo Checksums-Sha256: b6138dedbf19888a971066cae2bba10fac333ef4a64d5a809119515ee8aa6c75 570992 libssh-4-dbgsym_0.11.5-0+deb13u1_amd64.deb bc8cbc13617d1b21fa6f686f9f269a4f849f00624d5bb179785a058981701233 211924 libssh-4_0.11.5-0+deb13u1_amd64.deb c59f3c7159a63d7569c08c8fd51f667a4776a7e83570a86f952ce97dad9f9d7e 268564 libssh-dev_0.11.5-0+deb13u1_amd64.deb 98bc8b1a051579639608f015d36c258f277177ddaa565bb1dd52678dbdcf2d4b 8867 libssh_0.11.5-0+deb13u1_amd64-buildd.buildinfo Files: 57622a502b84638aa7b754ba025996ed 570992 debug optional libssh-4-dbgsym_0.11.5-0+deb13u1_amd64.deb cf348ab283fc2187fc8c0ef68a859635 211924 libs optional libssh-4_0.11.5-0+deb13u1_amd64.deb cfe6c3736cfd5510bc8619937c73c2a3 268564 libdevel optional libssh-dev_0.11.5-0+deb13u1_amd64.deb b14f6834561f1ea317f03c98023d725f 8867 libs optional libssh_0.11.5-0+deb13u1_amd64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmpuUA4ACgkQPkCWRKsh 20cCsA/7Bf6KbUwx+Uhbwbn1jQ4Slgp8dG8EIKa9I2LuFZHn0BAagF/VWczr9/yD lpZWM7EfqHvKdTxZ50u1UEKI7yuG4nwy9HZ9FPg1bZr1+zMgfNVW8XWANzjgoyn4 o2Fvk9hCvcKBDXbEGEFV8N9VsWHTIFoh2YPopwn/XBMM9Oe9r1ziGUh1ABC6ePYw y38if1PNYg+PnBaK0vq5/wXlyrUAmXLa0VY24n8gQOBS0LiUd8jCFung6Utvx6aX Xf3yuO2vXgPRRphlwvr0Kf3Lww5RUpc+i9B8n+tiADqQ5eCA0wcCY9cbUBJiMG4l qBigxKabYliSlmTB0wAZkdzxHOSbM9dkht+lvvCE1uplWtoMan85cDwU8UWC4bED NJ7Z3JZZWXhhvSHyG3q3adZUdIQCJ9CN/G/sz+qe5+pg25nWypgWQGA0FEJwNbW0 lODOd2vUAHZNYv+n3s9Lqm3FKhoH2LgYeEu4rxFwSviafDVXzjA1QSm8l6P106X7 GOkFMznqJPRr4nlX0mJOnepHNwMgXvchlLadlEL67gVWs+yjgDQTTNolIbRAIDLM KuBO0zlcPQagGVXxJuXTr3aIzm4azW+J6YW5RHVTd3A+EnKgBtaKblh/mdiCgxXF qAP68eZtDqO5a6Rd5+fuveMeeu3ciQdc9xmztdk4Y5kMTSHbahk= =rSmx -----END PGP SIGNATURE-----