-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 26 Nov 2025 10:29:30 +0100 Source: libssh Binary: libssh-4 libssh-4-dbgsym libssh-dev libssh-gcrypt-4 libssh-gcrypt-4-dbgsym libssh-gcrypt-dev Architecture: mipsel Version: 0.10.6-0+deb12u2 Distribution: bookworm Urgency: medium Maintainer: mipsel Build Daemon (mipsel-osuosl-05) Changed-By: Emilio Pozuelo Monfort Description: libssh-4 - tiny C SSH library (OpenSSL flavor) libssh-dev - tiny C SSH library - Development files (OpenSSL flavor) libssh-gcrypt-4 - tiny C SSH library (gcrypt flavor) libssh-gcrypt-dev - tiny C SSH library - Development files (gcrypt flavor) Closes: 1108407 Changes: libssh (0.10.6-0+deb12u2) bookworm; urgency=medium . [ Martin Pitt ] * stable-security → bookworm-security * Backport security patches from 0.11.2. - CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions - CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() - CVE-2025-5318: Likely read beyond bounds in sftp server handle management - CVE-2025-5351: Double free in functions exporting keys - CVE-2025-5372: ssh_kdf() returns a success code on certain failures - CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL backend https://www.libssh.org/2025/06/24/libssh-0-11-2-security-and-bugfix-release/ (Closes: #1108407) . [ Emilio Pozuelo Monfort ] * Add patch for CVE-2025-8114 * Add patches for CVE-2025-8277 Checksums-Sha1: 19099934fff2d829803d4bcecf7120a278338ac0 516612 libssh-4-dbgsym_0.10.6-0+deb12u2_mipsel.deb b4f18bf0f36be690f12c6e619f163200552edd0b 164772 libssh-4_0.10.6-0+deb12u2_mipsel.deb c8bb2365276de9826483a3e35bc22fc9d07a0c39 256248 libssh-dev_0.10.6-0+deb12u2_mipsel.deb 3c3491ef3c92c842421ee51a425e0eea444f4c7e 551620 libssh-gcrypt-4-dbgsym_0.10.6-0+deb12u2_mipsel.deb 15316dcc54961042aa0d324fcb3d428c389e0bf1 195248 libssh-gcrypt-4_0.10.6-0+deb12u2_mipsel.deb b7e6ddade83424102e73dcec122afa186d1f2b5b 288880 libssh-gcrypt-dev_0.10.6-0+deb12u2_mipsel.deb 14e00cf8407e6488ba94cfe2da09903cd2d43948 9431 libssh_0.10.6-0+deb12u2_mipsel-buildd.buildinfo Checksums-Sha256: bee89cc86b7a89b78beccaaf2e4bc970059236c53ee81e67a4db8f124f7632a5 516612 libssh-4-dbgsym_0.10.6-0+deb12u2_mipsel.deb 6d41b9e366980443b3f70f8b81599dce6e693eac329b1dca461fcaa461f004a8 164772 libssh-4_0.10.6-0+deb12u2_mipsel.deb 217d2390ce2d3e2a5acd5bc423a6867f21a764f6968d499e1b2a01e2c9a5b17b 256248 libssh-dev_0.10.6-0+deb12u2_mipsel.deb 0e18227b285ebccfe622ab69666e1d1d7d6f797c49645d8c8dad827b04a16e2a 551620 libssh-gcrypt-4-dbgsym_0.10.6-0+deb12u2_mipsel.deb d220f23f74d067e9bcbb35d3e4e118fe6c5f918d9a83e3baffc25dc3f70f6887 195248 libssh-gcrypt-4_0.10.6-0+deb12u2_mipsel.deb 6c77e71e181bd6fc23fe981bdf20d780a28678c5af34ec9cfa60afcd90b54a3d 288880 libssh-gcrypt-dev_0.10.6-0+deb12u2_mipsel.deb 5c5242e29fea9be8e93c59c29130373d651d192735fdf716c89a930ab9101d52 9431 libssh_0.10.6-0+deb12u2_mipsel-buildd.buildinfo Files: ee54a761911c419be7dc4551008d7ec1 516612 debug optional libssh-4-dbgsym_0.10.6-0+deb12u2_mipsel.deb 01ffe30484e0c44e85fc30d96a08e65a 164772 libs optional libssh-4_0.10.6-0+deb12u2_mipsel.deb cfbab9b180aeb4ba49328cc56b8ecc90 256248 libdevel optional libssh-dev_0.10.6-0+deb12u2_mipsel.deb 99c506e65474d4c9a8c7bac0e5291e0b 551620 debug optional libssh-gcrypt-4-dbgsym_0.10.6-0+deb12u2_mipsel.deb 64415915777f375a14c3119441d3242a 195248 libs optional libssh-gcrypt-4_0.10.6-0+deb12u2_mipsel.deb 2a97b5657e234e943f519cd935dab75c 288880 libdevel optional libssh-gcrypt-dev_0.10.6-0+deb12u2_mipsel.deb abc56a353ff83a7945f13c532c026a1f 9431 libs optional libssh_0.10.6-0+deb12u2_mipsel-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEYLhEzFkGpb3yYRVHmlVdU6AM9BUFAmk0HSgACgkQmlVdU6AM 9BWX9RAAtgoSgj+hxMLg4zKIjj9CiTIfcbxky6abLkNVEMbYLcIL4AOlEQqa07Y0 IJ4YbdKGvECXEWZzsK19keuxbAgmhFFLXsakj9QYnBYkJmQT7NrM6H4653luIlfb sNMiK6hnqHlPARHx+hvyT4V3xRXRYWWG586TZcMtM23wbo+DZ94enqDxtqQ8aPui JZMW0y+uSQwz/FmGXIrHf4/lfbpI9cW0CgZJOhLMBVgj653h/u22WcisMpeZERtj 4R0/KmKIT2FrEUZ5YiFVv/XdeLghnSdlX4wu7TZ4v0vEO3MzqNVtSN+rlVVvJC5B +t39TgfrJavmajLmLdBCDpGEk6+wgdbDt+/cH2Bf7DMOkyE1/tmjyXIUSB/EwHgS inTQD59rjFN7OEddNSBonE1wXJRZAIaASRXyHU8qOMV5d23DTBGjJgVvRjwowiDZ 9O0L9USkMAiQKltjkWc98q5wuOsNFIeH2ruCU4fVzg9AN+p7wz1HspDHnGOplQXq 1aDBsa3u21GVx2XSD99T0vGS59+appz588ysx5DgNqDDuL2qqbDk20mGDu37PX8r SQQJvEWsMoeJiye2wLHAYDBKiP1AMHUYYjH7I1o7TiEUOdxxCZpaDTtqy79eF83s GTOaiDSvOqQf0Nuwa1DBd/LOr2HPW5IU8mW10VLreTbvHQMEicU= =yrye -----END PGP SIGNATURE-----