SUSE-SU-2026:1344-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-20261344-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1344-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:1344-1
- Upstream
- Related
- Published
- 2026-04-15T10:21:31Z
- Modified
- 2026-04-16T08:30:50.129098Z
- Summary
- Security update for libssh
- Details
-
This update for libssh fixes the following issues:
- CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).
- CVE-2026-0964: SCP protocol path traversal in
ssh_scp_pull_request()(bsc#1258049). - CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
- CVE-2026-0966: buffer underflow in
ssh_get_hexa()on invalid input (bsc#1258054). - CVE-2026-0967: specially crafted patterns could cause a denial of service (bsc#1258081).
- CVE-2026-0968: out-of-bounds read in
sftp_parse_longname()(bsc#1258080).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-20261344-1/
- https://bugzilla.suse.com/1258045
- https://bugzilla.suse.com/1258049
- https://bugzilla.suse.com/1258054
- https://bugzilla.suse.com/1258080
- https://bugzilla.suse.com/1258081
- https://bugzilla.suse.com/1259377
- https://www.suse.com/security/cve/CVE-2026-0964
- https://www.suse.com/security/cve/CVE-2026-0965
- https://www.suse.com/security/cve/CVE-2026-0966
- https://www.suse.com/security/cve/CVE-2026-0967
- https://www.suse.com/security/cve/CVE-2026-0968
- https://www.suse.com/security/cve/CVE-2026-3731