changeset 1332:6aaec171e88e

add CVEs and patch urls
author Matt Johnston <>
date Thu, 15 Sep 2016 21:43:57 +0800
parents ab06e093d1e1
children 6fafb500de88
diffstat 1 files changed, 12 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/CHANGES	Wed May 10 00:20:33 2017 +0800
+++ b/CHANGES	Thu Sep 15 21:43:57 2016 +0800
@@ -9,16 +9,24 @@
   A dbclient user who can control username or host arguments could potentially
   run arbitrary code as the dbclient user. This could be a problem if scripts
   or webpages pass untrusted input to the dbclient program.
+  CVE-2016-7406
 - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
   the local dropbearconvert user when parsing malicious key files
+  CVE-2016-7407
 - Security: dbclient could run arbitrary code as the local dbclient user if
   particular -m or -c arguments are provided. This could be an issue where
   dbclient is used in scripts.
+  CVE-2016-7408
 - Security: dbclient or dropbear server could expose process memory to the
   running user if compiled with DEBUG_TRACE and running with -v
+  CVE-2016-7409
   The security issues were reported by an anonymous researcher working with
   Beyond Security's SecuriTeam Secure Disclosure
@@ -64,6 +72,7 @@
 - Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions,
   found by Thanks for Damien Miller for a patch. CVE-2016-3116
 2015.71 - 3 December 2015
@@ -342,9 +351,11 @@
 - Limit the size of decompressed payloads, avoids memory exhaustion denial
   of service 
   Thanks to Logan Lamb for reporting and investigating it. CVE-2013-4421
 - Avoid disclosing existence of valid users through inconsistent delays
   Thanks to Logan Lamb for reporting. CVE-2013-4434
 - Update config.guess and config.sub for newer architectures
@@ -447,6 +458,7 @@
   This bug affects releases 0.52 onwards. Ref CVE-2012-0920.
   Thanks to Danny Fullerton of Mantor Organization for reporting
   the bug.
 - Compile fix, only apply IPV6 socket options if they are available in headers
   Thanks to Gustavo Zacarias for the patch