From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security] libssh (SSA:2026-202-01)
Date: Tue, 21 Jul 2026 17:29:43 -0700 (PDT)





-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] libssh (SSA:2026-202-01)

New libssh packages are available for Slackware 15.0 and -current to
fix security issues.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/libssh-0.11.5-i586-1_slack15.0.txz: Upgraded.
This update fixes security issues:
Stack buffer overflow in SFTP server longname construction.
Denial of service via zero advertised channel packet size.
Denial of service via oversized SFTP read length.
Denial of service via unchecked ProxyCommand fork() failure.
Information disclosure via ProxyCommand %r username expansion.
Integrity downgrade via OpenSSL AES-GCM tag verification.
Denial of service via SFTP responses with unknown request IDs.
Denial of service via automatic certificate authentication loop.
Use-after-free via data callbacks on closed channels.
Zero-initialize every ssh_string.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-15370
https://www.cve.org/CVERecord?id=CVE-2026-59843
https://www.cve.org/CVERecord?id=CVE-2026-59844
https://www.cve.org/CVERecord?id=CVE-2026-59845
https://www.cve.org/CVERecord?id=CVE-2026-59846
https://www.cve.org/CVERecord?id=CVE-2026-59847
https://www.cve.org/CVERecord?id=CVE-2026-59848
https://www.cve.org/CVERecord?id=CVE-2026-59849
https://www.cve.org/CVERecord?id=CVE-2026-59850
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/libssh-0.11.5-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/libssh-0.11.5-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libssh-0.12.1-i686-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/libssh-0.12.1-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 15.0 package:
fc3aa3b43df45ca2f56b7ce893349004 libssh-0.11.5-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
f7e6b1f037fec2be10fb188b148f52a1 libssh-0.11.5-x86_64-1_slack15.0.txz

Slackware -current package:
7c71c6735698fa981b7bc002ce6b60c5 l/libssh-0.12.1-i686-1.txz

Slackware x86_64 -current package:
5cbced800f2425577eec6ace1c9b12ea l/libssh-0.12.1-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg libssh-0.11.5-i586-1_slack15.0.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iHkEARECADkWIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCamAOZxsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIACgkQakRjwEAQIjNspgCaAsRKT8VDqQQj1YiFxN7A
feFhPYMAniQ8FKunC5umQibIzdrg1GuiBiFX
=p4nR
-----END PGP SIGNATURE-----

Senaste Kernels