diff -Nru openssh-5.9p1/debian/changelog openssh-5.9p1/debian/changelog --- openssh-5.9p1/debian/changelog 2015-08-14 13:11:24.000000000 +0000 +++ openssh-5.9p1/debian/changelog 2015-08-18 01:53:20.000000000 +0000 @@ -1,3 +1,11 @@ +openssh (1:5.9p1-5ubuntu1.7) precise-security; urgency=medium + + * SECURITY REGRESSION: random auth failures because of uninitialized + struct field (LP: #1485719) + - debian/patches/CVE-2015-5600-2.patch: + + -- Marc Deslauriers Mon, 17 Aug 2015 21:53:19 -0400 + openssh (1:5.9p1-5ubuntu1.6) precise-security; urgency=medium * SECURITY UPDATE: possible user impersonation via PAM support diff -Nru openssh-5.9p1/debian/patches/CVE-2015-5600-2.patch openssh-5.9p1/debian/patches/CVE-2015-5600-2.patch --- openssh-5.9p1/debian/patches/CVE-2015-5600-2.patch 1970-01-01 00:00:00.000000000 +0000 +++ openssh-5.9p1/debian/patches/CVE-2015-5600-2.patch 2015-08-18 01:53:15.000000000 +0000 @@ -0,0 +1,16 @@ +Description: fix random auth failures because of uninitialized struct field +Author: Benn Sundsrud +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1485719 + +Index: openssh-6.6p1/auth2-chall.c +=================================================================== +--- openssh-6.6p1.orig/auth2-chall.c 2015-08-17 21:52:45.843249437 -0400 ++++ openssh-6.6p1/auth2-chall.c 2015-08-17 21:52:45.843249437 -0400 +@@ -131,6 +131,7 @@ + kbdintctxt->ctxt = NULL; + kbdintctxt->device = NULL; + kbdintctxt->nreq = 0; ++ kbdintctxt->devices_done = 0; + + return kbdintctxt; + } diff -Nru openssh-5.9p1/debian/patches/series openssh-5.9p1/debian/patches/series --- openssh-5.9p1/debian/patches/series 2015-08-14 13:06:58.000000000 +0000 +++ openssh-5.9p1/debian/patches/series 2015-08-18 01:53:15.000000000 +0000 @@ -54,3 +54,4 @@ pam-security-1.patch pam-security-2.patch CVE-2015-5352.patch +CVE-2015-5600-2.patch