[CLSA-2026:1791823540] Fix CVE(s): CVE-2025-15661, CVE-2026-7598

Type:

security

Severity:

Critical

Release date:

2026-10-19 15:58:53 UTC

Description:

   * SECURITY UPDATE: out-of-bounds heap read in SFTP symlink handling
     - debian/patches/CVE-2025-15661.patch: validate that the link length
       in a SSH_FXP_NAME response fits within the received packet before
       copying it in sftp_symlink() in src/sftp.c
     - CVE-2025-15661

CVEs fixed:

Updated packages:

libssh2-1_1.8.0-2.1ubuntu0.1+tuxcare.els4_amd64.deb
sha:e3038e5fd0ed0a7dc84532fc6ab2691ffa51fea4
libssh2-1-dev_1.8.0-2.1ubuntu0.1+tuxcare.els4_amd64.deb
sha:9e8902fd981234847f4a29a352c192174f4010ee
libssh2-1_1.8.0-2.1ubuntu0.1+tuxcare.els4_arm64.deb
sha:138d49fdf49a0bc30836284b80060257caf27d40
libssh2-1-dev_1.8.0-2.1ubuntu0.1+tuxcare.els4_arm64.deb
sha:424339a201df325f38fb2783f9995b380151fe2f

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.