Changeset 812bd24 in oe-alliance-core

[dropbear][security][bugfix] Bump to 2016.74
dropbear 71 was affected by multiple security issues

Excerpt from fixes:

• Security: Message printout was vulnerable to format string injection. CVE-2016-7406 ​https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb

• Security: dropbearconvert import of OpenSSH keys could run arbitrary code as the local dropbearconvert user when parsing malicious key files CVE-2016-7407 ​https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e

• Security: dbclient could run arbitrary code as the local dbclient user if particular -m or -c arguments are provided. This could be an issue where dbclient is used in scripts. CVE-2016-7408 ​https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6

• Security: dbclient or dropbear server could expose process memory to the running user if compiled with DEBUG_TRACE and running with -v CVE-2016-7409 ​https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04

The security issues were reported by an anonymous researcher working with
Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html

• Fix port forwarding failure when connecting to domains that have both IPv4 and IPv6 addresses. The bug was introduced in 2015.68

• Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P for the patch

2016.73 - 18 March 2016

• Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks

2016.72 - 9 March 2016

• Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. CVE-2016-3116 ​https://secure.ucc.asn.au/hg/dropbear/rev/a3e8389e01ff