- Update to 1.4.2ac5616dc78
libssh2 -- multiple issuesentered 2019-04-18
CVE-2019-3855, CVE-2019-3856, CVE-2019-3857, CVE-2019-3858, CVE-2019-3859, CVE-2019-3860, CVE-2019-3861, CVE-2019-3862, CVE-2019-3863
Library implementing the SSH2 protocol
# pkg install libssh2installs 1.11.1_1,3 from latest; from quarterly (2026Q4) 1.11.1_1,3# cd /usr/ports/security/libssh2 && make install clean# make -C /usr/ports/security/libssh2 config # change options first
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 1.11.1_1,3 | 1.11.1_1,3 | – |
| FreeBSD 15 | 1.11.1_1,3 | 1.11.1_1,3 | – |
| FreeBSD 14 | 1.11.1_1,3 | 1.11.1_1,3 | 1.11.1_1,3 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 1.11.1_1,3 | 1.11.1_1,3 | – |
| FreeBSD 14 | 1.11.1_1,3 | 1.11.1_1,3 | 1.11.1_1,3 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
The CVE record lists the packaged version 1.11.1_1,3 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-55200 | 9.2 | 2026-06-17 | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field… |
| CVE-2026-66032 | 8.7 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to cor… |
| CVE-2026-66033 | 8.7 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that … |
| CVE-2026-58050 | 8.3 | 2026-06-28 | libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_p… |
| CVE-2026-58051 | 8.3 | 2026-06-28 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the… |
| CVE-2025-15661 | 8.3 | 2026-06-18 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious S… |
| CVE-2026-55199 | 8.2 | 2026-06-17 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allow… |
| CVE-2026-66034 | 7.7 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out… |
| CVE-2026-66035 | 7.7 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap meta… |
| CVE-2026-7598 | 6.9 | 2026-05-01 | A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation … |
Listed in VuXML, the packaged version 1.11.1_1,3 is still in the affected range; pkg audit reports it. What does this mean?
CVE-2019-3855, CVE-2019-3856, CVE-2019-3857, CVE-2019-3858, CVE-2019-3859, CVE-2019-3860, CVE-2019-3861, CVE-2019-3862, CVE-2019-3863
- Update to 1.4.2ac5616dc78
- Update to 1.4.1 Approved by: jadawin@, miwi@ (mentors, implicit)ba99ff9e32
- Fix build when using GCRYPT KNOB - Bump PORTREVISION PR: ports/164835 Submitted by: Hirohisa Yamaguchi <umq at ueo.co.jp> Approved by: jadawin@, miwi@ (mentors, implicit)908d44f398
- Update to 1.4.0 Approved by: jadawin@, miwi@ (mentors, implicit)0ba4ae9ea0
- Remove WITH_FBSD10_FIX, is no longer needede1c6649edf
- Fix build on FreeBSD 10 Reported by: pointyhat69a39f5f38
- Update to 1.3.0 Approved by: jadawin@ (mentor)f045d303f8
- Update to 1.2.9 - Update pkg-descr - Make happy portlint Approved by: miwi@ (mentor)ffbbeb4e91
- Chase the libgcrypt shared lib versione0755b977d
- Fix version of pkg-config - Bump PORTREVISION PR: ports/158195 Submitted by: mandree@ Approved by: miwi@ (mentor)a8e7678ba0
- Update to 1.2.8 - Add LICENSE Approved by: jadawin@ (mentor)29417500d3
Update my MAINTAINER address to sbz at FreeBSD.org. Approved by: jadawin@ (mentor)d7c5457ddf
- Update to 1.2.7 PR: ports/149799 Submitted by: Sofian Brabez <sbrabez _AT_ gmail.com>8f63b3f7d4
Chase security/libgcrypt shlib bump. PR: ports/148755 Submitted by: Hirohisa Yamaguchi <umq@ueo.co.jp>15c1551ea3
- Update to 1.2.6 PR: 147846 Submitted by: Sofian Brabez <sbrabez@gmail.com> (maintainer)98eadcd5db
Update to 1.2.5 and hand maintainership to Sofian Brabez. PR: ports/145760 Submitted by: sbrabez@gmail.com31ae7c69e0
Update to 1.2.4. PR: ports/144202 Submitted by: Sofian Brabez <sbrabez@gmail.com> Feature safe: yes1dfd3e6b7b
Update to 1.2.3. PR: ports/143542 Submitted by: Sofian Brabez3a80948661
- Add TRACE and ZLIB options PR: ports/140711 Submitted by: Sofian Brabez <sbrabez@gmail.com> Approved by: maintainer timeout (lx; 18 days)d86dba7bdc
Update to 1.2.2. PR: ports/140626 Submitted by: David Naylor Feature safe: yes713f338423
Remove @dirrmtry for libdata/pkgconfig directory. This directory is in BSD.local.dist. Submitted by: QAT Feature safe: yes3febcac536
Support libgcrypt, and update to 1.2.1, a bugfix release. PR: ports/138473 Submitted by: Peter Wullinger Feature safe: yesc8f53ebab5
Update to 1.2. PR: 137760 Submitted by: Sofian Brabez Approved by: maintainer3d31f1b2a9
Update to 1.1. PR: ports/133336 Submitted by: Sofian Brabez <sbrabez@gmail.com> Approved by: lx (maintainer)77a0c6a037
Argh. So, the update notifier was wrong, and 0.2 is not a new release (of course), but I was fooled because there's a separate project called libssh which *did* just have a new release. 1.0 is the real update. Pointed out by: J. Johnston1319a93963
Include appropriate openssl headers.e28e692846
Update to 0.2.14d05cde40
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script. Specifically, newer autoconf (> 2.13) has different semantic of the configure target. In short, one should use --build=CONFIGURE_TARGET instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning and the old semantic may be removed in later autoconf releases.
To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.
To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.
Changes to Mk/*:
- Add runtime detection magic in bsd.port.mk
- Remove CONFIGURE_TARGET hack in various bsd.*.mk
- USE_GNOME=gnometarget is now an no-op
Changes to individual ports, other than removing the CONFIGURE_TARGET hack:
= pkg-plist changed (due to the ugly CONFIGURE_TARGET prefix in * executables)
- comms/gnuradio
- science/abinit
- science/elmer-fem
- science/elmer-matc
- science/elmer-meshgen2d
- science/elmerfront
- science/elmerpost
= use x86_64 as ARCH
- devel/g-wrap
= other changes
- print/magicfilter
GNU_CONFIGURE -> HAS_CONFIGURE since it's not generated by autoconf
Total # of ports modified: 1,027
Total # of ports affected: ~7,000 (set GNU_CONFIGURE to yes)
PR: 126524 (obsoletes 52917)
Submitted by: rafan
Tested on: two pointyhat 7-amd64 exp runs (by pav)
Approved by: portmgr (pav)741aa71483Update to 0.18.0f45e3e389
Update to 0.17.a8df590e93
- Set --mandir and --infodir in CONFIGURE_ARGS if the configure script supports them. This is determined by running ``configure --help'' in do-configure target and set the shell variable _LATE_CONFIGURE_ARGS which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - PR: ports/111470 Approved by: portmgr Discussed with: stas (Mk/*), gerald (info related stuffs) Tested by: pointyhat exp runf935a609c5
Updating to 0.15.4be47df624
- Provide a patch to fix a bug in the configure script that caused the include and library directory flags to gcc to be wrong - Bump PORTREVISION PR: 102920 Submitted by: David Thiel <lx@redundancy.redundancy.org> (maintainer)3b3202afc1
- Updating libssh2 to 0.14. Changes: - Plug leaks in EVP cipher init/shutdown. (Selcuk Gueney) - Allow socket_fd == 0 in libssh2_session_startup(). (puudeli) - Swap ordering of packet_add/packet-inspection to avoid inspect after - free. (Selcuk) - Swap KEX_INIT ordering, send our KEX_INIT first. - Add check for oportunistic KEX_INIT packets. Burn bad guess if necessary. - Fix OpenSS PR: ports/100127 Submitted by: maintainer (David Thiel)4ff3f1b6ad
- Adopt PR: ports/97860 Submitted by: David Thiel <lx@redundancy.redundancy.org>3b0689b2ca
- update to 0.1331e6338ce2
Update to 0.12 Add SHA256 PR: 89239 Submitted by: KATO Tsuguru <tkato432@yahoo.com>c493ac0ce4
- Update to 0.11. PR: ports/83401 Submitted by: Marcus Grando <marcus@corp.grupos.com.br>a7633f04ef
- Update to 0.10 PR: ports/82280 Submitted by: Ports Fury1295f99ab3
Fix post-install target. Noticed by: pointyhat (via kris)14663c511b
libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10).d2ae1f9d87