MGASA-2026-0273
- Source
- https://advisories.mageia.org/MGASA-2026-0273.html
- Import Source
- https://advisories.mageia.org/MGASA-2026-0273.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2026-0273
- Upstream
- Published
- 2026-07-20T19:06:32Z
- Modified
- 2026-07-20T19:20:56.035464062Z
- Summary
- Updated libssh2 packages fix security vulnerabilities
- Details
-
The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink() in sftp.c. (CVE-2025-15661) libssh2 userauth.c userauthpassword integer overflow. (CVE-2026-7598) Pre-Authentication DoS via SSHMSGEXTINFO Handler. (CVE-2026-55199) Out-of-Bounds Write via Unchecked packetlength in transport.c. (CVE-2026-55200) Integer Overflow in publickey Subsystem Attribute Allocation. (CVE-2026-58050) Free of Uninitialized Pointer in publickey List Cleanup. (CVE-2026-58051)
- References
-
- https://advisories.mageia.org/MGASA-2026-0273.html
- https://bugs.mageia.org/show_bug.cgi?id=35616
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRU63FODXZBBO73NFWUI32A2A36ETDQZ/
- https://www.openwall.com/lists/oss-security/2026/06/23/10
- https://www.openwall.com/lists/oss-security/2026/06/23/11
- https://lists.debian.org/debian-security-announce/2026/msg00276.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZREI4LITT4U2ZXPEEVVNALFKPLXGLAFM/
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SRBHQ76PA4ZHTWY5F4ESYPYF3G2NLGWI/
- https://ubuntu.com/security/notices/USN-8486-1
- https://ubuntu.com/security/notices/USN-8532-1
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:10 / libssh2
Package
- Name
- libssh2
- Purl
- pkg:rpm/mageia/libssh2?arch=source&distro=mageia-10
Mageia:9 / libssh2
Package
- Name
- libssh2
- Purl
- pkg:rpm/mageia/libssh2?arch=source&distro=mageia-9