UbuntuUpdates.org

Package "libssh2-1t64"

Name: libssh2-1t64

Description:

SSH2 client-side library
Latest version: 1.11.0-4.1ubuntu0.24.04.2
Release: noble (24.04)
Level: security
Repository: main
Head package: libssh2
Homepage: https://libssh2.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libssh2-1t64"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libssh2-1t64" in Noble

Repository Area Version
base main 1.11.0-4.1build2
updates main 1.11.0-4.1ubuntu0.24.04.2

Changelog

Version: 1.11.0-4.1ubuntu0.24.04.2 2026-06-30 14:07:28 UTC

  libssh2 (1.11.0-4.1ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: OOB read in sftp_symlink()
    - debian/patches/CVE-2025-15661-pre1.patch: add LIBSSH2_UNCONST() in
      src/libssh2_priv.h.
    - debian/patches/CVE-2025-15661.patch: Update sftp_symlink to avoid out of
      bounds read on malformed packet in src/sftp.c.
    - CVE-2025-15661
  * SECURITY UPDATE: pre-authentication denial of service via CPU loop
    - debian/patches/CVE-2026-55199.patch: packet: check `_libssh2_get_string()`
      return in `EXT_INFO` handler in src/packet.c.
    - CVE-2026-55199

 -- Marc Deslauriers <email address hidden> Mon, 29 Jun 2026 09:20:49 -0400
Source diff to previous version
CVE-2025-15661 libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that
CVE-2026-55199 libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src

Version: 1.11.0-4.1ubuntu0.24.04.1 2026-05-26 21:07:26 UTC

  libssh2 (1.11.0-4.1ubuntu0.24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: integer overflow via long username
    - debian/patches/CVE-2026-7598.patch: add username_len bounds checking in
      src/userauth.c.
    - CVE-2026-7598

 -- Marc Deslauriers <email address hidden> Tue, 05 May 2026 12:49:00 -0400
CVE-2026-7598 A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c


About   -   Send Feedback to @ubuntu_updates