- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201402-26 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: libssh: Arbitrary code execution Date: February 21, 2014 Bugs: #444147 ID: 201402-26 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in libssh, allowing attackers to execute arbitrary code or cause Denial of Service. Background ========== libssh is a C library providing SSHv2 and SSHv1. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/libssh < 0.5.3 >= 0.5.3 Description =========== Multiple buffer overflow, double free, and integer overflow vulnerabilities have been discovered in libssh. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround ========== There is no known workaround at this time. Resolution ========== All libssh users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libssh-0.5.3" References ========== [ 1 ] CVE-2012-4559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4559 [ 2 ] CVE-2012-4560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4560 [ 3 ] CVE-2012-4561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4561 [ 4 ] CVE-2012-4562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4562 [ 5 ] CVE-2012-6063 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6063 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201402-26.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5