Sophie: dropbear-2014.66-1.3.mga5 x86

dropbear-2014.66-1.3.mga5.x86_64.rpm

Thu May 25 2017 danf <danf> 2014.66-1.3.mga5
+ Revision: 1104504
- Fix a couple of security issues (bug #20901)
- Fix double-free in server TCP listener cleanup (CVE-2017-9078)
- Fix information disclosure with ~/.ssh/authorized_keys symlink (CVE-2017-9079)
- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
the local dropbearconvert user when parsing malicious key files
- Security: Message printout was vulnerable to format string injection.
If specific usernames including "%" symbols can be created on a system
(validated by getpwnam()) then an attacker could run arbitrary code as root
when connecting to Dropbear server.
A dbclient user who can control username or host arguments could potentially
run arbitrary code as the dbclient user. This could be a problem if scripts
or webpages pass untrusted input to the dbclient program.
- Security: dbclient could run arbitrary code as the local dbclient user if
particular -m or -c arguments are provided. This could be an issue where
dbclient is used in scripts.
- Added xauth-validation.patch to fix CVE-2016-3116
Wed Nov 5 2014 danf <danf> 2014.66-1.mga5
+ Revision: 795872
- Update to 2014.66 (bugfix release)
Wed Oct 15 2014 umeabot <umeabot> 2014.65-4.mga5
+ Revision: 750973
- Second Mageia 5 Mass Rebuild
Sun Oct 5 2014 danf <danf> 2014.65-3.mga5
+ Revision: 736930
- Use system-provided libtommath and libtomcrypto (mga#11036)
Tue Sep 16 2014 umeabot <umeabot> 2014.65-2.mga5
+ Revision: 678863
- Mageia 5 Mass Rebuild

+ tv
- s/uggests:/Recommends:/
Wed Sep 3 2014 danf <danf> 2014.65-1.mga5
+ Revision: 671153
- Upgraded to version 2014.65. Major changes include:
- The -K keepalive option now behaves more like OpenSSH's ServerAliveInterval
- Rework TCP priority setting.
- Numerous bug fixes
- Added syslog as a prerequisite for startup by systemd
- Added to RSA and DSS the generation of an ECDSA host key on first startup