dropbear 2016.74-5 source package in Ubuntu

Changelog

dropbear (2016.74-5) unstable; urgency=high

  * Backport security fixes from 2017.75 (closes: #862970):
    - CVE-2017-9078: Fix double-free in server TCP listener cleanup
      A double-free in the server could be triggered by an authenticated user
      if dropbear is running with -a (Allow connections to forwarded ports
      from any host) This could potentially allow arbitrary code execution as
      root by an authenticated user.
    - CVE-2017-9079: Fix information disclosure with ~/.ssh/authorized_keys
      symlink.
      Dropbear parsed authorized_keys as root, even if it were a symlink. The
      fix is to switch to user permissions when opening authorized_keys
      A user could symlink their ~/.ssh/authorized_keys to a root-owned file
      they couldn't normally read. If they managed to get that file to contain
      valid authorized_keys with command= options it might be possible to read
      other contents of that file.
      This information disclosure is to an already authenticated user.

 -- Guilhem Moulin <email address hidden>  Fri, 19 May 2017 23:41:21 +0200