logo
DATABASE RESOURCES PRICING ABOUT US

[slackware-security] openssh

Description

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/openssh-7.4p1-i586-1_slack14.2.txz: Upgraded. This is primarily a bugfix release, and also addresses security issues. ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside a trusted whitelist. sshd(8): When privilege separation is disabled, forwarded Unix-domain sockets would be created by sshd(8) with the privileges of 'root'. sshd(8): Avoid theoretical leak of host private key material to privilege-separated child processes via realloc(). sshd(8): The shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimising compilers to potentially allow attacks against the privileged monitor. process from the sandboxed privilege-separation process. sshd(8): Validate address ranges for AllowUser and DenyUsers directives at configuration load time and refuse to accept invalid ones. It was previously possible to specify invalid CIDR address ranges (e.g. user@127.1.2.3/55) and these would always match, possibly resulting in granting access where it was not intended. For more information, see: https://www.openssh.com/txt/release-7.4 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10009 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10010 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10011 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10012 (* Security fix *) Where to find the new packages: Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/openssh-7.4p1-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/openssh-7.4p1-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/openssh-7.4p1-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/openssh-7.4p1-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/openssh-7.4p1-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/openssh-7.4p1-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openssh-7.4p1-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openssh-7.4p1-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openssh-7.4p1-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openssh-7.4p1-x86_64-1_slack14.1.txz Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssh-7.4p1-i586-1_slack14.2.txz Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssh-7.4p1-x86_64-1_slack14.2.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-7.4p1-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssh-7.4p1-x86_64-1.txz MD5 signatures: Slackware 13.0 package: 7fce1ebdb63b97beaeb98f450676171c openssh-7.4p1-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 26fbf1aa33f5b289b15435a904b5d2a0 openssh-7.4p1-x86_64-1_slack13.0.txz Slackware 13.1 package: 5b8a87019ca527acba1f607af9175cfb openssh-7.4p1-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 29aa129063c2667612485edeac5c072b openssh-7.4p1-x86_64-1_slack13.1.txz Slackware 13.37 package: 6d9aabce1fc85756b7863cbf1cf389a9 openssh-7.4p1-i486-1_slack13.37.txz Slackware x86_64 13.37 package: e57e264dccefc2621bd45838d96bb10d openssh-7.4p1-x86_64-1_slack13.37.txz Slackware 14.0 package: 7613f561db6b8616ec2b0a283e4487d6 openssh-7.4p1-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 7a834d8b295da5ea88bac1340e359711 openssh-7.4p1-x86_64-1_slack14.0.txz Slackware 14.1 package: 45c8e0c84e13d0c0a9914087898cefbd openssh-7.4p1-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 8e66d220fb2c3da97bf912a487436ac6 openssh-7.4p1-x86_64-1_slack14.1.txz Slackware 14.2 package: 690e285ce2aeeee6f670451034ae3ec6 openssh-7.4p1-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 6a2b3846149a9f8071f2751aed452f53 openssh-7.4p1-x86_64-1_slack14.2.txz Slackware -current package: e0d8576b19ebe4da64f5d72474693295 n/openssh-7.4p1-i586-1.txz Slackware x86_64 -current package: 1a8bbe8129a9c28fb9eb98b202646b46 n/openssh-7.4p1-x86_64-1.txz Installation instructions: Upgrade the package as root: > upgradepkg openssh-7.4p1-i586-1_slack14.2.txz Next, restart the sshd daemon: > sh /etc/rc.d/rc.sshd restart


Affected Package


OS OS Version Package Name Package Version
Slackware 13.0 openssh 7.4p1
Slackware 13.0 openssh 7.4p1
Slackware 13.1 openssh 7.4p1
Slackware 13.1 openssh 7.4p1
Slackware 13.37 openssh 7.4p1
Slackware 13.37 openssh 7.4p1
Slackware 14.0 openssh 7.4p1
Slackware 14.0 openssh 7.4p1
Slackware 14.1 openssh 7.4p1
Slackware 14.1 openssh 7.4p1
Slackware 14.2 openssh 7.4p1
Slackware 14.2 openssh 7.4p1
Slackware current openssh 7.4p1
Slackware current openssh 7.4p1

Related