important: httpd/libssh2 security update
important
An update for httpd/libssh2 is now available for NewStart CGSL MAIN 7.02.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
httpd:
libssh2:
Security Fix(es):
httpd: A server side include handling flaw has been discovered in the Apache HTTP server. When Server Side Includes (SSI) areenabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives an attacker may be able to inject commands executed by the server.(CVE-2025-58098)
httpd: bugfix
libssh2: A flaw in libssh2's sftp_symlink() function allows a malicious SSH server or man-in-the-middle attacker to trigger an out-of-bounds heap read via a crafted SSH_FXP_NAME response. This can disclose heap memory contents or crash the application, causing a denial of service (DoS).(CVE-2025-15661)
libssh2: A flaw in libssh2 allows a malicious SSH server to send a malformed public key response, triggering an invalid memory cleanup. This can cause the connecting client application to crash or leak information.(CVE-2026-58051)
libssh2: A flaw was found in the libssh2 library. A remote attacker can exploit an integer overflow vulnerability in the `userauth_password` function by manipulating the `username_len` or `password_len` arguments and cause a heap-based buffer overflow. This leads to a crash to the application linked to the library and potentially allows arbitrary code execution.(CVE-2026-7598)
libssh2: A vulnerability in libssh2 allows a malicious SSH server to freeze connected clients during the handshake process. By sending a malformed packet, the server triggers a loop that exhausts the client's CPU, resulting in a denial of service.(CVE-2026-55199)
libssh2: bugfix
Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 7.02.07B5.