diff -Nru openssh-6.7p1/debian/changelog openssh-6.7p1/debian/changelog --- openssh-6.7p1/debian/changelog 2015-08-14 13:05:07.000000000 +0000 +++ openssh-6.7p1/debian/changelog 2015-08-18 01:52:16.000000000 +0000 @@ -1,3 +1,11 @@ +openssh (1:6.7p1-5ubuntu1.3) vivid-security; urgency=medium + + * SECURITY REGRESSION: random auth failures because of uninitialized + struct field (LP: #1485719) + - debian/patches/CVE-2015-5600-2.patch: + + -- Marc Deslauriers Mon, 17 Aug 2015 21:49:49 -0400 + openssh (1:6.7p1-5ubuntu1.2) vivid-security; urgency=medium * SECURITY UPDATE: possible user impersonation via PAM support diff -Nru openssh-6.7p1/debian/patches/CVE-2015-5600-2.patch openssh-6.7p1/debian/patches/CVE-2015-5600-2.patch --- openssh-6.7p1/debian/patches/CVE-2015-5600-2.patch 1970-01-01 00:00:00.000000000 +0000 +++ openssh-6.7p1/debian/patches/CVE-2015-5600-2.patch 2015-08-18 01:51:47.000000000 +0000 @@ -0,0 +1,16 @@ +Description: fix random auth failures because of uninitialized struct field +Author: Benn Sundsrud +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1485719 + +Index: openssh-6.7p1/auth2-chall.c +=================================================================== +--- openssh-6.7p1.orig/auth2-chall.c 2015-08-17 15:02:19.000000000 -0400 ++++ openssh-6.7p1/auth2-chall.c 2015-08-17 21:49:25.757575709 -0400 +@@ -132,6 +132,7 @@ + kbdintctxt->ctxt = NULL; + kbdintctxt->device = NULL; + kbdintctxt->nreq = 0; ++ kbdintctxt->devices_done = 0; + + return kbdintctxt; + } diff -Nru openssh-6.7p1/debian/patches/series openssh-6.7p1/debian/patches/series --- openssh-6.7p1/debian/patches/series 2015-08-14 12:59:11.000000000 +0000 +++ openssh-6.7p1/debian/patches/series 2015-08-18 01:48:51.000000000 +0000 @@ -31,3 +31,4 @@ pam-security-1.patch pam-security-2.patch CVE-2015-5352.patch +CVE-2015-5600-2.patch