MGASA-2018-0006

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2018-0006.html
Import Source
https://advisories.mageia.org/MGASA-2018-0006.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2018-0006
Related
Published
2018-01-01T10:38:51Z
Modified
2018-01-01T10:10:04Z
Summary
Updated openssh packages fix security vulnerability
Details

It was found that the boundary checks in the code implementing support for pre-authentication compression could have been optimized out by certain compilers. An attacker able to compromise the privilege-separated process could possibly use this flaw for further attacks against the privileged monitor process (CVE-2016-10012).

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files (CVE-2017-15906).

References
Credits

Affected packages

Mageia:5 / openssh

Package

Name
openssh
Purl
pkg:rpm/mageia/openssh?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6p1-5.10.mga5

Ecosystem specific 

{
    "section": "core"
}