Stay Secure with the Latest Linux Advisories

security advisorysecurity updatebuffer overflow

openSUSE 13.2 Advisory: Critical OpenSSH Buffer Overflow Issues

An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available.. openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0127-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-39=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): openssh-6.6p1-5.3.1 openssh-askpass-gnome-6.6p1-5.3.1 openssh-askpass-gnome-debuginfo-6.6p1-5.3.1 openssh-debuginfo-6.6p1-5.3.1 openssh-debugsource-6.6p1-5.3.1 openssh-fips-6.6p1-5.3.1 openssh-helpers-6.6p1-5.3.1 openssh-helpers-debuginfo-6.6p1-5.3.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/show_bug.cgi?id=961642 https://bugzilla.suse.com/show_bug.cgi?id=961645 . Essential openSUSE upgrade for OpenSSH addresses two critical problems: risk of private key leakage and buffer overflow flaws.. OpenSSH Update, openSUSE Security, SSH Security Update. . Severity: Critical. LinuxSecurity.com Team

Jan 15, 2016 •Critical OpenSUSE