* SECURITY UPDATE: Integer overflow leading to out-of-bounds write when SSH_MSG_CHANNEL_REQUEST packets with exit signal messages are parsed. - debian/patches/CVE-2019-3857.patch: check namelen + 1 does not overflow before allocation in exit-signal handling. - CVE-2019-3857 * SECURITY UPDATE: Integer overflow in bounds check in SSH_MSG_DISCONNECT packet parsing enabling out-of-bounds read. - debian/patches/CVE-2019-17498.patch: harden bounds checking in SSH_MSG_DISCONNECT, SSH_MSG_DEBUG, and SSH_MSG_GLOBAL_REQUEST handlers to prevent unsigned integer underflow and overflow. - CVE-2019-17498