{"affected":[{"ecosystem_specific":{"binaries":[{"openssh":"6.6p1-21.1","openssh-askpass-gnome":"6.6p1-21.3","openssh-fips":"6.6p1-21.1","openssh-helpers":"6.6p1-21.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","name":"openssh","purl":"pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.6p1-21.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"openssh":"6.6p1-21.1","openssh-askpass-gnome":"6.6p1-21.3","openssh-fips":"6.6p1-21.1","openssh-helpers":"6.6p1-21.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","name":"openssh-askpass-gnome","purl":"pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.6p1-21.3"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"openssh":"6.6p1-21.1","openssh-askpass-gnome":"6.6p1-21.3","openssh-fips":"6.6p1-21.1","openssh-helpers":"6.6p1-21.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","name":"openssh","purl":"pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.6p1-21.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"openssh":"6.6p1-21.1","openssh-askpass-gnome":"6.6p1-21.3","openssh-fips":"6.6p1-21.1","openssh-helpers":"6.6p1-21.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","name":"openssh-askpass-gnome","purl":"pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.6p1-21.3"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"openssh was updated to fix three security issues.\n\nThese security issues were fixed:\n- CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions  (bsc#970632).\n- CVE-2016-1908: Possible fallback from untrusted to trusted X11 forwarding (bsc#962313).\n- CVE-2015-8325: Ignore PAM environment vars when UseLogin=yes (bsc#975865).\n\nThese non-security issues were fixed:\n- Correctly parse GSSAPI KEX algorithms (bsc#961368)\n- More verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)\n- Fix PRNG re-seeding (bsc#960414, bsc#729190)\n- Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)\n- Allow empty Match blocks (bsc#961494) \n  ","id":"SUSE-SU-2016:1528-1","modified":"2016-06-08T10:46:21Z","published":"2016-06-08T10:46:21Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161528-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/729190"},{"type":"REPORT","url":"https://bugzilla.suse.com/932483"},{"type":"REPORT","url":"https://bugzilla.suse.com/948902"},{"type":"REPORT","url":"https://bugzilla.suse.com/960414"},{"type":"REPORT","url":"https://bugzilla.suse.com/961368"},{"type":"REPORT","url":"https://bugzilla.suse.com/961494"},{"type":"REPORT","url":"https://bugzilla.suse.com/962313"},{"type":"REPORT","url":"https://bugzilla.suse.com/965576"},{"type":"REPORT","url":"https://bugzilla.suse.com/970632"},{"type":"REPORT","url":"https://bugzilla.suse.com/975865"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8325"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1908"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-3115"}],"related":["CVE-2015-8325","CVE-2016-1908","CVE-2016-3115"],"summary":"Security update for openssh","upstream":["CVE-2015-8325","CVE-2016-1908","CVE-2016-3115"]}