Security bugs are reported here via bugzilla

[Hamish Greig <hgreig AT bigpond.net.au>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 16 Sep 2003 22:42, Niki Guldbrand wrote:
> Hi ppl.
>
> Well there is allready a new openssh 3.7p1 on there ftp site
> ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/
>
> But i haven't seen any info further info about the bugs yet
>
>
The following is tha last entry on the changelog in the ftp dir from above.
I went looking for proof of a new release after i saw lace had updated devel 
and test.
As long as the changelog is authentic it would seem to be fixed.
I would be happier if the release had been officially announced but i am just 
paranoid since the gnu servers got owned for months.
Hamish
20030916
 - (dtucker) [acconfig.h configure.ac defines.h session.c] Bug #252: Retrieve
   PATH (or SUPATH) and UMASK from /etc/default/login on platforms that have 
it
   (eg Solaris, Reliant Unix).  Patch from Robert.Dahlem at siemens.com.
   ok djm@
 - (bal) OpenBSD Sync
   - deraadt AT cvs.openbsd.org 2003/09/16 03:03:47
     [buffer.c]
     do not expand buffer before attempting to reallocate it; markus ok
 - (djm) Crank spec versions
 - (djm) Banish (safe) sprintf from auth-pam.c. Patch from bal
 - (tim) [configure.ac] Fix portability issues.
 - (djm) Release 3.7p1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/Zxdt8fSufZR6424RApkjAJwMLKbBBlwCJ7C4iJ6taMXwf0kkRACfa01l
l+hRgaA0KXZZu6Z99SrW5L8=
=sayQ
-----END PGP SIGNATURE-----