[Buildroot] [PATCH 0/5] package/libssh2: fix five security vulnerabilities

This series backports fixes for five libssh2 security vulnerabilities

affecting version 1.11.1.

CVE-2025-15661 requires the upstream SFTP bounds checking fix, a

LIBSSH2_UNCONST compatibility backport for libssh2 1.11.1, and the

upstream follow-up fixing SSH_FXP_STATUS handling.

The remaining four commits fix a dangling pointer in SFTP processing,

AES-GCM bounds checking, a publickey out-of-bounds read, and a

potential heap overflow in the ETM decrypt path.

Matching LIBSSH2_IGNORE_CVES entries are added for all five CVEs.

The patches were checked with check-package and git diff --check, and

all patches apply successfully to libssh2 1.11.1.

The fixes also apply to the 2025.02.x maintenance branch; each commit

contains a corresponding Backport to: 2025.02.x note.

Stefan Müller (5):

package/libssh2: fix CVE-2025-15661

package/libssh2: fix CVE-2026-66032

package/libssh2: fix CVE-2026-66033

package/libssh2: fix CVE-2026-66034

package/libssh2: fix CVE-2026-66035

...-sftp-symlink-fix-out-of-bounds-read.patch | 116 ++++++++++++++++++

...ibssh2-priv-backport-LIBSSH2_UNCONST.patch | 29 +++++

...-symlink-fix-SSH_FXP_STATUS-response.patch | 46 +++++++

...-prevent-dangling-pointer-after-free.patch | 28 +++++

...08-openssl-fix-AES-GCM-bounds-checks.patch | 44 +++++++

...009-publickey-fix-potential-OOB-read.patch | 35 ++++++

...tential-heap-overflow-on-ETM-decrypt.patch | 41 +++++++

package/libssh2/libssh2.mk | 17 +++

8 files changed, 356 insertions(+)

create mode 100644 package/libssh2/0004-sftp-symlink-fix-out-of-bounds-read.patch

create mode 100644 package/libssh2/0005-libssh2-priv-backport-LIBSSH2_UNCONST.patch

create mode 100644 package/libssh2/0006-sftp-symlink-fix-SSH_FXP_STATUS-response.patch

create mode 100644 package/libssh2/0007-sftp-prevent-dangling-pointer-after-free.patch

create mode 100644 package/libssh2/0008-openssl-fix-AES-GCM-bounds-checks.patch

create mode 100644 package/libssh2/0009-publickey-fix-potential-OOB-read.patch

create mode 100644 package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

--

2.25.1

Freundliche GrüsseStefan MüllerREY TECHNOLOGY AGRütihofstrasse 6, CH-8370 SirnachStefan Müller | CTODirect +41 58 810 04 82 | Support +41 58 810 04 [email protected] | rey-technology.com

https://www.linkedin.com/company/rey-technology https://www.instagram.com/reytechnology_com/ https://teams.microsoft.com/l/chat/0/[email protected]

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot