Description: CVE-2025-4877 Write beyond bounds in binary to base64 conversion functions CVE-2025-4878 Use of uninitialized variable in privatekey_from_file() CVE-2025-5318 Likely read beyond bounds in sftp server handle management CVE-2025-5351 Double free in functions exporting keys CVE-2025-5372 ssh_kdf() returns a success code on certain failures CVE-2025-5449 Likely read beyond bounds in sftp server message decoding CVE-2025-5987 Invalid return code for chacha20 poly1305 with OpenSSL backend
Description: CVE-2025-4877 Write beyond bounds in binary to base64 conversion functions CVE-2025-4878 Use of uninitialized variable in privatekey_from_file() CVE-2025-5318 Likely read beyond bounds in sftp server handle management CVE-2025-5351 Double free in functions exporting keys CVE-2025-5372 ssh_kdf() returns a success code on certain failures CVE-2025-5449 Likely read beyond bounds in sftp server message decoding CVE-2025-5987 Invalid return code for chacha20 poly1305 with OpenSSL backend
- - - - - - - - -
-
-
-
-
-
-
-
-
-
- 9/core/libssh-0.10.6-1.1.mga9
- 9/core/libssh-0.10.6-1.1.mga9
Publication date: 10 Jun 2026 URL: https: //advisories.mageia.org/MGASA-2026-0189.html Type: security CVE: CVE-2025-4877, CVE-2025-4878, CVE-2025-5318, CVE-2025-5351, CVE-2025-5372, CVE-2025-5449, CVE-2025-5987
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
