SUSE-SU-2026:21396-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202621396-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21396-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:21396-1
- Upstream
- Related
- Published
- 2026-04-30T09:40:57Z
- Modified
- 2026-05-01T18:44:39Z
- Summary
- Security update for libssh
- Details
-
This update for libssh fixes the following issues:
- Update to version 0.11.4:
- CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
- CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
- CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
- CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
- CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
- CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
- CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202621396-1/
- https://bugzilla.suse.com/1246974
- https://bugzilla.suse.com/1249375
- https://bugzilla.suse.com/1258045
- https://bugzilla.suse.com/1258049
- https://bugzilla.suse.com/1258054
- https://bugzilla.suse.com/1258080
- https://bugzilla.suse.com/1258081
- https://www.suse.com/security/cve/CVE-2025-8114
- https://www.suse.com/security/cve/CVE-2025-8277
- https://www.suse.com/security/cve/CVE-2026-0964
- https://www.suse.com/security/cve/CVE-2026-0965
- https://www.suse.com/security/cve/CVE-2026-0966
- https://www.suse.com/security/cve/CVE-2026-0967
- https://www.suse.com/security/cve/CVE-2026-0968