SUSE-SU-2026:3330-1: moderate: Security update for libssh

OPENSUSE-SECURITY-UPDATES <[email protected]> Tue, 28 Jul 2026 16:45:57 -0000
Newsgroups gmane.linux.suse.security.announce
Message-ID <178525715767.499.14776448425009922771@cdce4c525ac1>
--===============4201161863967500712==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

# Security update for libssh

Announcement ID: SUSE-SU-2026:3330-1  
Release Date: 2026-07-28T09:36:04Z  
Rating: moderate  
References:

  * bsc#1272164
  * bsc#1272165
  * bsc#1272166
  * bsc#1272167
  * bsc#1272168
  * bsc#1272169
  * bsc#1272171

  
Cross-References:

  * CVE-2026-59843
  * CVE-2026-59844
  * CVE-2026-59845
  * CVE-2026-59846
  * CVE-2026-59847
  * CVE-2026-59848
  * CVE-2026-59850

  
CVSS scores:

  * CVE-2026-59843 ( SUSE ):  7.1
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-59843 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-59843 ( NVD ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-59844 ( SUSE ):  7.1
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-59844 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-59844 ( NVD ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-59845 ( SUSE ):  8.2
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
  * CVE-2026-59845 ( SUSE ):  6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  * CVE-2026-59845 ( NVD ):  5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H
  * CVE-2026-59846 ( SUSE ):  2.4
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-59846 ( SUSE ):  3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
  * CVE-2026-59846 ( NVD ):  3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
  * CVE-2026-59847 ( SUSE ):  8.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-59847 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
  * CVE-2026-59847 ( NVD ):  5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  * CVE-2026-59848 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-59848 ( SUSE ):  3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-59848 ( NVD ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-59850 ( SUSE ):  5.3
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-59850 ( SUSE ):  4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-59850 ( NVD ):  4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

  
Affected Products:

  * Basesystem Module 15-SP7
  * openSUSE Leap 15.6
  * SUSE Linux Enterprise Desktop 15 SP7
  * SUSE Linux Enterprise Real Time 15 SP7
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server 15 SP6 LTSS
  * SUSE Linux Enterprise Server 15 SP7
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP7

  
  
An update that solves seven vulnerabilities can now be installed.

## Description:

This update for libssh fixes the following issues:

  * CVE-2026-59843: denial of service via zero advertised channel packet size
    (bsc#1272164).
  * CVE-2026-59844: denial of service via oversized SFTP read length
    (bsc#1272165).
  * CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure
    (bsc#1272166).
  * CVE-2026-59846: information disclosure via ProxyCommand %r username
    expansion (bsc#1272167).
  * CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification
    (bsc#1272168).
  * CVE-2026-59848: denial of service via SFTP responses with unknown request
    IDs (bsc#1272169).
  * CVE-2026-59850: use-after-free via data callbacks on closed channels
    (bsc#1272171).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server for SAP Applications 15 SP6  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3330=1

  * Basesystem Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3330=1

  * SUSE Linux Enterprise Server 15 SP6 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3330=1

  * openSUSE Leap 15.6  
    zypper in -t patch SUSE-2026-3330=1

## Package List:

  * openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)
    * libssh4-debuginfo-0.9.8-150600.11.15.1
    * libssh-config-0.9.8-150600.11.15.1
    * libssh4-0.9.8-150600.11.15.1
    * libssh-devel-0.9.8-150600.11.15.1
    * libssh-debugsource-0.9.8-150600.11.15.1
  * openSUSE Leap 15.6 (x86_64)
    * libssh4-32bit-0.9.8-150600.11.15.1
    * libssh4-32bit-debuginfo-0.9.8-150600.11.15.1
  * openSUSE Leap 15.6 (aarch64_ilp32)
    * libssh4-64bit-0.9.8-150600.11.15.1
    * libssh4-64bit-debuginfo-0.9.8-150600.11.15.1
  * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
    * libssh4-debuginfo-0.9.8-150600.11.15.1
    * libssh-config-0.9.8-150600.11.15.1
    * libssh4-0.9.8-150600.11.15.1
    * libssh-devel-0.9.8-150600.11.15.1
    * libssh-debugsource-0.9.8-150600.11.15.1
  * Basesystem Module 15-SP7 (x86_64)
    * libssh4-32bit-0.9.8-150600.11.15.1
    * libssh4-32bit-debuginfo-0.9.8-150600.11.15.1
  * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
    * libssh4-debuginfo-0.9.8-150600.11.15.1
    * libssh-config-0.9.8-150600.11.15.1
    * libssh4-0.9.8-150600.11.15.1
    * libssh-devel-0.9.8-150600.11.15.1
    * libssh-debugsource-0.9.8-150600.11.15.1
  * SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
    * libssh4-32bit-0.9.8-150600.11.15.1
    * libssh4-32bit-debuginfo-0.9.8-150600.11.15.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
    * libssh4-32bit-0.9.8-150600.11.15.1
    * libssh4-32bit-debuginfo-0.9.8-150600.11.15.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
    * libssh4-debuginfo-0.9.8-150600.11.15.1
    * libssh-config-0.9.8-150600.11.15.1
    * libssh4-0.9.8-150600.11.15.1
    * libssh-devel-0.9.8-150600.11.15.1
    * libssh-debugsource-0.9.8-150600.11.15.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-59843.html
  * https://www.suse.com/security/cve/CVE-2026-59844.html
  * https://www.suse.com/security/cve/CVE-2026-59845.html
  * https://www.suse.com/security/cve/CVE-2026-59846.html
  * https://www.suse.com/security/cve/CVE-2026-59847.html
  * https://www.suse.com/security/cve/CVE-2026-59848.html
  * https://www.suse.com/security/cve/CVE-2026-59850.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1272164
  * https://bugzilla.suse.com/show_bug.cgi?id=1272165
  * https://bugzilla.suse.com/show_bug.cgi?id=1272166
  * https://bugzilla.suse.com/show_bug.cgi?id=1272167
  * https://bugzilla.suse.com/show_bug.cgi?id=1272168
  * https://bugzilla.suse.com/show_bug.cgi?id=1272169
  * https://bugzilla.suse.com/show_bug.cgi?id=1272171


--===============4201161863967500712==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit




<div class="container">
    <h1>Security update for libssh</h1>

    <table class="table table-striped table-bordered">
        <tbody>
        <tr>
            <th>Announcement ID:</th>
            <td>SUSE-SU-2026:3330-1</td>
        </tr>
        <tr>
            <th>Release Date:</th>
            <td>2026-07-28T09:36:04Z</td>
        </tr>
        
        <tr>
            <th>Rating:</th>
            <td>moderate</td>
        </tr>
        <tr>
            <th>References:</th>
            <td>
                <ul>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272164">bsc#1272164</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272165">bsc#1272165</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272166">bsc#1272166</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272167">bsc#1272167</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272168">bsc#1272168</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272169">bsc#1272169</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272171">bsc#1272171</a>
                        </li>
                    
                    
                </ul>
            </td>
        </tr>
        
            <tr>
                <th>
                    Cross-References:
                </th>
                <td>
                    <ul>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2026-59843.html">CVE-2026-59843</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2026-59844.html">CVE-2026-59844</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2026-59845.html">CVE-2026-59845</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2026-59846.html">CVE-2026-59846</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2026-59847.html">CVE-2026-59847</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2026-59848.html">CVE-2026-59848</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2026-59850.html">CVE-2026-59850</a>
                        </li>
                    
                    </ul>
                </td>
            </tr>
            <tr>
                <th>CVSS scores:</th>
                <td>
                    <ul class="list-group">
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59843</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">7.1</span>
                                <span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59843</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.5</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59843</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.5</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59844</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">7.1</span>
                                <span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59844</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.5</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59844</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.5</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59845</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">8.2</span>
                                <span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59845</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.5</span>
                                <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59845</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">5.3</span>
                                <span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59846</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">2.4</span>
                                <span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59846</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">3.9</span>
                                <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59846</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">3.9</span>
                                <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59847</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">8.3</span>
                                <span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59847</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.5</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59847</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">5.9</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59848</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.3</span>
                                <span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59848</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">3.7</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59848</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">5.3</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59850</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">5.3</span>
                                <span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59850</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">4.3</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2026-59850</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">4.3</span>
                                <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
                            </li>
                        
                    </ul>
                </td>
            </tr>
        
        <tr>
            <th>Affected Products:</th>
            <td>
                <ul class="list-group">
                    
                        <li class="list-group-item">Basesystem Module 15-SP7</li>
                    
                        <li class="list-group-item">openSUSE Leap 15.6</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Desktop 15 SP7</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Real Time 15 SP7</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server 15 SP6</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server 15 SP6 LTSS</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server 15 SP7</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP6</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP7</li>
                    
                </ul>
            </td>
        </tr>
        </tbody>
    </table>

    <p>An update that solves seven vulnerabilities can now be installed.</p>

    


    
        <h2>Description:</h2>
    
    <p>This update for libssh fixes the following issues:</p>
<ul>
<li>CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).</li>
<li>CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).</li>
<li>CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).</li>
<li>CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).</li>
<li>CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).</li>
<li>CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).</li>
<li>CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).</li>
</ul>



    

    <h2>Patch Instructions:</h2>
    <p>
        To install this SUSE  update use the SUSE recommended
        installation methods like YaST online_update or "zypper patch".<br/>

        Alternatively you can run the command listed for your product:
    </p>
    <ul class="list-group">
        
            <li class="list-group-item">
                SUSE Linux Enterprise Server for SAP Applications 15 SP6
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3330=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                Basesystem Module 15-SP7
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3330=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE Linux Enterprise Server 15 SP6 LTSS
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3330=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                openSUSE Leap 15.6
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-2026-3330=1</code>
                    
                    
                
            </li>
        
    </ul>

    <h2>Package List:</h2>
    <ul>
        
            
                <li>
                    openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)
                    <ul>
                        
                            <li>libssh4-debuginfo-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-config-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-devel-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-debugsource-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
                <li>
                    openSUSE Leap 15.6 (x86_64)
                    <ul>
                        
                            <li>libssh4-32bit-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-32bit-debuginfo-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
                <li>
                    openSUSE Leap 15.6 (aarch64_ilp32)
                    <ul>
                        
                            <li>libssh4-64bit-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-64bit-debuginfo-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
                    <ul>
                        
                            <li>libssh4-debuginfo-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-config-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-devel-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-debugsource-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
                <li>
                    Basesystem Module 15-SP7 (x86_64)
                    <ul>
                        
                            <li>libssh4-32bit-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-32bit-debuginfo-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
                    <ul>
                        
                            <li>libssh4-debuginfo-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-config-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-devel-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-debugsource-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
                <li>
                    SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
                    <ul>
                        
                            <li>libssh4-32bit-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-32bit-debuginfo-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
                    <ul>
                        
                            <li>libssh4-32bit-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-32bit-debuginfo-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
                <li>
                    SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
                    <ul>
                        
                            <li>libssh4-debuginfo-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-config-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh4-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-devel-0.9.8-150600.11.15.1</li>
                        
                            <li>libssh-debugsource-0.9.8-150600.11.15.1</li>
                        
                    </ul>
                </li>
            
        
    </ul>

    
        <h2>References:</h2>
        <ul>
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2026-59843.html">https://www.suse.com/security/cve/CVE-2026-59843.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2026-59844.html">https://www.suse.com/security/cve/CVE-2026-59844.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2026-59845.html">https://www.suse.com/security/cve/CVE-2026-59845.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2026-59846.html">https://www.suse.com/security/cve/CVE-2026-59846.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2026-59847.html">https://www.suse.com/security/cve/CVE-2026-59847.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2026-59848.html">https://www.suse.com/security/cve/CVE-2026-59848.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2026-59850.html">https://www.suse.com/security/cve/CVE-2026-59850.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272164">https://bugzilla.suse.com/show_bug.cgi?id=1272164</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272165">https://bugzilla.suse.com/show_bug.cgi?id=1272165</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272166">https://bugzilla.suse.com/show_bug.cgi?id=1272166</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272167">https://bugzilla.suse.com/show_bug.cgi?id=1272167</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272168">https://bugzilla.suse.com/show_bug.cgi?id=1272168</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272169">https://bugzilla.suse.com/show_bug.cgi?id=1272169</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1272171">https://bugzilla.suse.com/show_bug.cgi?id=1272171</a>
                    </li>
                
            
        </ul>
    
</div>

--===============4201161863967500712==--