Peter Korsgaard
fb4c55b0b5
package/libssh2: security bump to latest git
...
Bump the version to latest git to fix the following security issues:
CVE-2019-3855
Possible integer overflow in transport read allows out-of-bounds write
URL: https://www.libssh2.org/CVE-2019-3855.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3855.patch
CVE-2019-3856
Possible integer overflow in keyboard interactive handling allows
out-of-bounds write
URL: https://www.libssh2.org/CVE-2019-3856.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3856.patch
CVE-2019-3857
Possible integer overflow leading to zero-byte allocation and out-of-bounds
write
URL: https://www.libssh2.org/CVE-2019-3857.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3857.patch
CVE-2019-3858
Possible zero-byte allocation leading to an out-of-bounds read
URL: https://www.libssh2.org/CVE-2019-3858.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3858.patch
CVE-2019-3859
Out-of-bounds reads with specially crafted payloads due to unchecked use of
`_libssh2_packet_require` and `_libssh2_packet_requirev`
URL: https://www.libssh2.org/CVE-2019-3859.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3859.patch
CVE-2019-3860
Out-of-bounds reads with specially crafted SFTP packets
URL: https://www.libssh2.org/CVE-2019-3860.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3860.patch
CVE-2019-3861
Out-of-bounds reads with specially crafted SSH packets
URL: https://www.libssh2.org/CVE-2019-3861.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3861.patch
CVE-2019-3862
Out-of-bounds memory comparison
URL: https://www.libssh2.org/CVE-2019-3862.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3862.patch
CVE-2019-3863
Integer overflow in user authenicate keyboard interactive allows
out-of-bounds writes
URL: https://www.libssh2.org/CVE-2019-3863.html
Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3863.txt
Drop 0003-openssl-fix-dereferencing-ambiguity-potentially-caus.patch as that
is now upstream.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be >
(cherry picked from commit f4f7dd9557peter@korsgaard.com >
2019-03-27 22:34:45 +01:00
Bernd Kuhls
d39c60da0e
package/libssh2: bump version
...
Added license hash.
This bump includes "ECDSA key types are now explicit"
62b825c8afhttp://git.videolan.org/?p=vlc.git;a=commitdiff;h=afee1e72a8e08866bbe35d1a57e859cac81052b4
Fixes
http://autobuild.buildroot.net/results/579/579e2418e59680ad4bf3dc85f2918457b6221bfa/
http://autobuild.buildroot.net/results/c73/c7348c442d3f585ace0bc62860f802dc08150776/
http://autobuild.buildroot.net/results/731/73187b883d7fe14b08a4903b326706c9d1f8b519/
http://autobuild.buildroot.net/results/f6d/f6d4fca6063c81a8e240fed4db89269e455f057e/
http://autobuild.buildroot.net/results/371/371f4f017f4a5af0ac6d6a8b1b8276858ad47f75/
http://autobuild.buildroot.net/results/d6a/d6a3b43211eb740bdebbb339668b854d26e878b7/
http://autobuild.buildroot.net/results/a05/a0576aeeb57a49958e5229d9ec08f2bd792d48b6/
http://autobuild.buildroot.net/results/57a/57a9ae2f157183a86fbf1b2cc5cbb38e948690ce/
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de >
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com >
(cherry picked from commit 9c31063b0fpeter@korsgaard.com >
2019-03-27 22:33:11 +01:00
Sam Voss
a660d1fc74
package/libssh2: update to newest version
...
Update libssh2 to use the newest version from git. This caused a
transition from released version number to hash as it has not been
version rev'd in over a year (see issue
https://github.com/libssh2/libssh2/issues/220 for bump request).
This brings in changes to the autoconf to correctly pick the crypto
library.
Signed-off-by: Sam Voss <sam.voss@rockwellcollins.com >
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com >
2017-11-01 10:56:14 +01:00
Baruch Siach
0dcf75eb7d
libssh2: bump to version 1.8.0
...
Signed-off-by: Baruch Siach <baruch@tkos.co.il >
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
2017-07-09 11:12:22 +02:00
Gustavo Zacarias
229ea8a18c
libssh2: security bump to version 1.7.0
...
Fixes:
CVE-2016-0787 - diffie_hellman_sha256: convert bytes to bits.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar >
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
2016-02-24 17:36:35 +01:00
Gustavo Zacarias
18df1fd088
libssh2: bump to version 1.6.0
...
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar >
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
2016-01-08 18:46:24 +01:00
Gustavo Zacarias
0df6ad5ddb
libssh2: security bump to version 1.5.0
...
Fixes CVE-2015-1782 - kex: bail out on rubbish in the incoming packet.
Also add hash file.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar >
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
2015-03-11 17:09:59 +01:00
