Stefan Müller 03757abfce package/libssh2: fix CVE-2026-66035 ...

Backport the fix for CVE-2026-66035.

The ETM decrypt path does not validate the received packet length before
calculating the decrypt buffer size. A malformed packet can therefore
lead to a heap overflow.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>

2026-08-22 23:54:17 +02:00

..

0001-username-len-bound-checking.patch

…

0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch

…

0003-transport-c-Additional-boundary-checks-for-packet-length.patch

…

0004-sftp-symlink-fix-out-of-bounds-read.patch

…

0005-libssh2-priv-backport-LIBSSH2_UNCONST.patch

…

0006-sftp-symlink-fix-SSH_FXP_STATUS-response.patch

…

0007-sftp-prevent-dangling-pointer-after-free.patch

…

0008-openssl-fix-AES-GCM-bounds-checks.patch

package/libssh2: fix CVE-2026-66033

2026-08-22 23:54:17 +02:00

0009-publickey-fix-potential-OOB-read.patch

package/libssh2: fix CVE-2026-66034

2026-08-22 23:54:17 +02:00

0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

package/libssh2: fix CVE-2026-66035

2026-08-22 23:54:17 +02:00

Config.in

…

libssh2.hash

…

libssh2.mk

package/libssh2: fix CVE-2026-66035

2026-08-22 23:54:17 +02:00