Debian Patches
Status for libssh2/1.11.1-5
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0001-Add-lgpg-error-to-.pc-to-facilitate-static-linking.patch | Add -lgpg-error to .pc to facilitate static linking Note that this patch is Debian-specific as we know that libssh2 is linked to gcrypt. Patching configure.ac to add gpg-error as a dependent library is not good, as it would cause overlinking of libssh2, and there is no separate variable for "static dependencies". All this mess ought to be solved in gcrypt inself by providing .pc file, but it is not. |
Mikhail Gusarov <dottedmag@dottedmag.net> | not-needed | 2014-09-03 | ||
| cve-2026-7598.patch | userauth.c: username_len bounds checking (#1858) Return errors when username_len will exceed bounds, fix existing bounds check. Credit: [dapickle](https://github.com/dapickle) |
Will Cosgrove <will@panic.com> | yes | 2026-04-13 | ||
| CVE-2025-15661.patch | Update sftp_symlink to avoid out of bounds read on malformed packet #1705 (#1717) | Will Cosgrove <will@panic.com> | no | 2025-10-10 | ||
| CVE-2026-55199.patch | packet: check `_libssh2_get_string()` return in `EXT_INFO` handler | TristanInSec <tristan.mtn@gmail.com> | no | 2026-04-15 | ||
| CVE-2026-55200.patch | transport.c: Additional boundary checks for packet length (#2052) | Will Cosgrove <will@panic.com> | no | 2026-06-12 | ||
| libssh-unconst-backport.patch | Needed by the fix for CVE-2025-15661 Cherrypicked from commit 606c102e52f8447de2b745dd6c5ddf418defc519 |
Viktor Szakats <commit@vsz.me> | no | 2025-01-30 | ||
| CVE-2026-66032.patch | Prevent dangling pointer by nullifying data (#2180) Set data to NULL after freeing it to avoid dangling pointer. fixes GHSA-px3w-7g75-hg7w. |
Will Cosgrove <will@panic.com> | not-needed | 2026-07-02 | ||
| CVE-2026-66033.patch | openssl: fix potential OOB read/write with AES-GCM in `ssh2_cipher_crypt()` By applying two bounds checks to non-debug builds. Fixes GHSA-c4f7-cvfc-33j7 Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 Closes #2401 |
Viktor Szakats <commit@vsz.me> | not-needed | 2026-07-23 | ||
| CVE-2026-66034.patch | publickey: fix potential OOB read in `libssh2_publickey_list_fetch()` Fixes GHSA-w6g9-cpfp-22gc Closes #2202 |
Viktor Szakats <commit@vsz.me> | not-needed | 2026-07-04 | ||
| CVE-2026-66035.patch | transport: fix potential heap overflow on ETM decrypt Fixes GHSA-6c79-444r-wx26 Closes #2198 |
Viktor Szakats <commit@vsz.me> | not-needed | 2026-07-03 |
All known versions for source package 'libssh2'
- 1.11.1-5 (forky, sid)
- 1.11.1-1+deb13u1 (trixie-security, trixie)
- 1.10.0-3 (bookworm)