Gentoo Linux Security Advisory 201606-12 - Multiple vulnerabilities have been found in libssh and libssh2, the worst of which allows remote attackers to cause Denial of Service. Versions less than 0.7.3 are affected.
a7682074939d8d39fdbac72c4a9138e844743c73c282548b5fb3e4eebea79c23
Slackware Security Advisory - New libssh packages are available for Slackware 14.0, 14.1, and -current to fix security issues.
d1c60898d3bb6fdb8ab9765889f38b999cc01a200e44d5db6df6716245d1769c
Mandriva Linux Security Advisory 2015-086 - When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id to the PRNG state, which is not guaranteed to be unique. The most important consequence is that servers using EC or DSA certificates may under certain conditions leak their private key. Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.
05034794c69e38df2effbf7e99ba466e4bdd8cd1c06e90c7380ffd81a37a83d6
Ubuntu Security Notice 2478-1 - It was discovered that libssh incorrectly handled certain kexinit packets. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service.
f9290ec437e7f5a67f27daca640706d51091fd5c4eafb244f218826c3647f564
Mandriva Linux Security Advisory 2015-020 - Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.
fd1ce300a03a1ae7c8aa5b610766951094c2ada644a79a3933187761ebedfe3f