openssh -- sshd -- remote valid user discovery and PAM /bin/login attack

The OpenSSH project reports:

• sshd(8): Mitigate timing differences in password authentication
  that could be used to discern valid from invalid account names
  when long passwords were sent and particular password hashing
  algorithms are in use on the server. CVE-2016-6210, reported by
  EddieEzra.Harari at verint.com

• sshd(8): (portable only) Ignore PAM environment vars when
  UseLogin=yes. If PAM is configured to read user-specified
  environment variables and UseLogin=yes in sshd_config, then a
  hostile local user may attack /bin/login via LD_PRELOAD or
  similar environment variables set via PAM. CVE-2015-8325,
  found by Shayan Sadigh.