SUSE-SU-2025:20596-1

CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)
CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL backend (bsc#1245317)
CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)
CVE-2025-4878: Use of uninitialized variable in privatekeyfromfile() (bsc#1245310)
CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)
CVE-2025-5351: Double free in functions exporting keys (bsc#1245312)

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.10.6-slfo.1.1_2.1

{
    "binaries": [
        {
            "libssh-config": "0.10.6-slfo.1.1_2.1",
            "libssh4": "0.10.6-slfo.1.1_2.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20596-1.json"