Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSH may allow unauthorized file access or privilege escalation
published 2 months ago
Summary
The OpenSSH program on your systems has several flaws that could let attackers see private data, cause service interruptions, or install files with elevated rights. Apply the latest OpenSSH update as soon as possible to close these gaps and keep your network secure.
What to do
- Update suse openssh to version 9.6p1-6.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Micro 6.0 | suse | openssh |
< 9.6p1-6.1 Fix: upgrade to 9.6p1-6.1
|
Original advisory text
Security update for openssh
This update for openssh fixes the following issues:
- CVE-2025-32728: fix logic error in DisableForwarding option (bsc#1241012).
- CVE-2026-3497: information disclosure or denial of service due to uninitialized variables (bsc#1259642).
- CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).
Other issues fixed::
- ignores write permissions for Group and World Directory Permissions (bsc#1241667).
- wall tool not longer printing any message to terminals (bsc#1239671)
- potential issue in validating mac (bsc#1264568):
* Improve %prep LDAP regex to preserve subdirectories (e.g., ope-
nbsd-compat/) and handle optional [ab]/ prefixes.
- CVE-2025-32728: fix logic error in DisableForwarding option (bsc#1241012).
- CVE-2026-3497: information disclosure or denial of service due to uninitialized variables (bsc#1259642).
- CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).
Other issues fixed::
- ignores write permissions for Group and World Directory Permissions (bsc#1241667).
- wall tool not longer printing any message to terminals (bsc#1239671)
- potential issue in validating mac (bsc#1264568):
* Improve %prep LDAP regex to preserve subdirectories (e.g., ope-
nbsd-compat/) and handle optional [ab]/ prefixes.
References
- https://www.suse.com/support/update/announcement/2026/suse-su-202623249-1/ Vendor Advisory
- https://bugzilla.suse.com/1239671 Third Party Advisory
- https://bugzilla.suse.com/1241012 Third Party Advisory
- https://bugzilla.suse.com/1241667 Third Party Advisory
- https://bugzilla.suse.com/1259642 Third Party Advisory
- https://bugzilla.suse.com/1261427 Third Party Advisory
- https://bugzilla.suse.com/1261430 Third Party Advisory
- https://bugzilla.suse.com/1261441 Third Party Advisory
- https://bugzilla.suse.com/1264568 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2025-32728 URL
- https://www.suse.com/security/cve/CVE-2026-3497 URL
- https://www.suse.com/security/cve/CVE-2026-35385 URL
- https://www.suse.com/security/cve/CVE-2026-35388 URL
- https://www.suse.com/security/cve/CVE-2026-35414 URL
Timeline
Published21 Aug 2026
Updated27 Aug 2026
First seen27 Aug 2026
Sources
SUSE-SU-2026:23249-1 · OSV
Track software like this
Free during beta