[Buildroot] [PATCH v2 0/5] package/libssh2: fix five security vulnerabilities

From: Stefan Müller <[email protected]>

This series backports upstream fixes for five security vulnerabilities
in libssh2.

Changes v1 -> v2:
  - Resend using a different SMTP provider because O365/Exchange
    converted the original patch emails to HTML.
  - No code changes.

Stefan Müller (5):
  package/libssh2: fix CVE-2025-15661
  package/libssh2: fix CVE-2026-66032
  package/libssh2: fix CVE-2026-66033
  package/libssh2: fix CVE-2026-66034
  package/libssh2: fix CVE-2026-66035

 ...-sftp-symlink-fix-out-of-bounds-read.patch | 116 ++++++++++++++++++
 ...ibssh2-priv-backport-LIBSSH2_UNCONST.patch |  29 +++++
 ...-symlink-fix-SSH_FXP_STATUS-response.patch |  46 +++++++
 ...-prevent-dangling-pointer-after-free.patch |  28 +++++
 ...08-openssl-fix-AES-GCM-bounds-checks.patch |  44 +++++++
 ...009-publickey-fix-potential-OOB-read.patch |  35 ++++++
 ...tential-heap-overflow-on-ETM-decrypt.patch |  41 +++++++
 package/libssh2/libssh2.mk                    |  17 +++
 8 files changed, 356 insertions(+)
 create mode 100644 package/libssh2/0004-sftp-symlink-fix-out-of-bounds-read.patch
 create mode 100644 package/libssh2/0005-libssh2-priv-backport-LIBSSH2_UNCONST.patch
 create mode 100644 package/libssh2/0006-sftp-symlink-fix-SSH_FXP_STATUS-response.patch
 create mode 100644 package/libssh2/0007-sftp-prevent-dangling-pointer-after-free.patch
 create mode 100644 package/libssh2/0008-openssl-fix-AES-GCM-bounds-checks.patch
 create mode 100644 package/libssh2/0009-publickey-fix-potential-OOB-read.patch
 create mode 100644 package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

-- 
2.25.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot