Security update for openssh

SUSE Security Update: Security update for openssh
Announcement ID: SUSE-SU-2018:2275-1
Rating: moderate
References: #1016370 #1017099 #1023275 #1053972 #1065000 #1069509 #1076957
Affected Products:
  • SUSE Linux Enterprise Server 11-SP4
  • SUSE Linux Enterprise Debuginfo 11-SP4
    		•

    An update that solves four vulnerabilities and has three fixes is now available.

    Description:

    This update for openssh fixes the following issues:

    Security issues fixed:

    - CVE-2016-10012: Fix pre-auth compression checks that could be optimized
    away (bsc#1016370).
    - CVE-2016-10708: Fix remote denial of service (NULL pointer dereference
    and daemon crash) via an out-of-sequence NEWKEYSmessage (bsc#1076957).
    - CVE-2017-15906: Fix r/o sftp-server zero byte file creation
    (bsc#1065000).
    - CVE-2008-1483: Fix accidental re-introduction of CVE-2008-1483
    (bsc#1069509).

    Bug fixes:

    - bsc#1017099: Match conditions with uppercase hostnames fail (bsc#1017099)
    - bsc#1053972: supportedKeyExchanges diffie-hellman-group1-sha1 is
    duplicated (bsc#1053972)
    - bsc#1023275: Messages suppressed after upgrade from SLES 11 SP3 to SP4
    (bsc#1023275)

    Patch Instructions:

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Server 11-SP4:
      zypper in -t patch slessp4-openssh-13719=1
    • SUSE Linux Enterprise Debuginfo 11-SP4:
      zypper in -t patch dbgsp4-openssh-13719=1

    Package List:

    • SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
      • openssh-6.6p1-36.3.1
      • openssh-askpass-gnome-6.6p1-36.3.1
      • openssh-fips-6.6p1-36.3.1
      • openssh-helpers-6.6p1-36.3.1
    • SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
      • openssh-askpass-gnome-debuginfo-6.6p1-36.3.1
      • openssh-debuginfo-6.6p1-36.3.1
      • openssh-debugsource-6.6p1-36.3.1

    References: