full-disclosure - [SECURITY] [DSA 2577-1] libssh security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20121201141332.472BA1BA9@scapa.corsac.net>
Date: Sat,  1 Dec 2012 15:13:27 +0100 (CET)
From: Yves-Alexis Perez <corsac@...ian.org>
To: debian-security-announce@...ts.debian.org
Subject: [SECURITY] [DSA 2577-1] libssh security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2577-1                   security@...ian.org
http://www.debian.org/security/                         Yves-Alexis Perez
December 01, 2012                      http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libssh
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-4559 CVE-2012-4561 CVE-2012-4562
Debian Bug      

Multiple vulnerabilities were discovered in libssh by Florian Weimer and Xi
Wang:

CVE-2012-4559: multiple double free() flaws
CVE-2012-4561: multiple invalid free() flaws
CVE-2012-4562: multiple improper overflow checks

Those could lead to a denial of service by making an ssh client linked to
libssh crash, and maybe even arbitrary code execution.

For the stable distribution (squeeze), these problems have been fixed in
version 0.4.5-3+squeeze1.

For the testing distribution (wheezy), these problems have been fixed in
version 0.5.3-1.

For the unstable distribution (sid), these problems have been fixed in
version 0.5.3-1.

We recommend that you upgrade your libssh packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)

iQEcBAEBCgAGBQJQuhCHAAoJEG3bU/KmdcClhN8H/2WeI/NZK6IvKI3JKRniLQxn
Z4RnjjW1au4yZ4b32+qVpLYQ0m8v5kuT5jR2geN95ZXCqk4iY4Jzg38iC1b2CPT5
8hs8y8uvzHwTgia/Rvi4fb9JnDun7bOn3ZInTGkSPpMx+bK38hRKLJ3BOzHsIfwD
WbLlm+Emhd+MJLj3GWoTudd/2wift1ATN7vQG+Dy+budAu9sVv2g3d3fvHGo9ggG
L6XCPRFzONwMgQT6jAwi2GcZYzJ8xK7KP4ELzjnf5yMKxuz2l026mhFK1JwErfWy
N/Rit3gcQ4hek+VSM9JCC5l9lzkvzE6Ldkc1CZu+kkU1Itt2Lez6zfwIJVdYRdc=
=pMqn
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/