| Summary: | <net-libs/libssh-0.3.4: multiple overflows | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Thomas Beinicke <merlin> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | CC: | netmon |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | ~2 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | |||
| Bug Blocks: | 289676 | ||
0.3.4 is in the tree. Looks like we need to actually stabilise something greater than 0.1.1 (formerly 0.11) this time. It works fine with the kde4 kioslaves which it depends on I don't know what other packages depend on it though. Stabilizing might be a good idea though. (In reply to comment #1) > 0.3.4 is in the tree. Looks like we need to actually stabilise something > greater than 0.1.1 (formerly 0.11) this time. Yup. We'll open bug in a month or... well since kde uses it we'll have to stabilize them together I guess. Anyway no need to keep fixed bugs open. Err, I closed and after that noticed that this bug is assigned on security... it's just there are no security tags Status Whiteboard... Well, some distributions issued security announcements for this package (FreeBSD, Suse), so I think we need at least fast stabilize this new version. http://www.watchmouse.com/en/vulnerability_solutions/SuSE-Security-Update-libssh-2009-09-22-.html Arch teams, please, stabilize libssh-0.3.4. x86 stable ppc stable Thanks everyone. I've got a novell account, but their bugtracker says: "You are not authorized to access bug #540628." Closing noglsa. netmon: please remove the old versions. (In reply to comment #9) > netmon: please remove the old versions. done. |
Version bump to 0.3.4. A simple change of the ebuild name and regenerating the manifest worked. KDE4 trunk depends on 0.3.4 as well, here is the changelog. ChangeLog: * Added ssh_basename() and ssh_dirname(). * Added a portable ssh_mkdir function(). * Added a sftp_tell64() function. * Added missing NULL pointer checks to crypt_set_algorithms_server. * Fixed ssh_write_knownhost if ~/.ssh doesn’t exist. * Fixed a possible integer overflow in buffer_get_data(). * Fixed possible security bug in packet_decrypt(). * Fixed a possible stack overflow in agent code. Reproducible: Always Steps to Reproduce: