Description of the patch:
This update for libssh fixes the following issues:
- CVE-2026-15370: stack buffer overflow in SFTP server longname construction (bsc#1272162).
- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).
- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).
- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).
- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).
- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).
- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).
- CVE-2026-59849: denial of service via automatic certificate authentication loop (bsc#1272170).
- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).
Changes for libssh:
- Zero-initialize every ssh_string
- Fix compatibility with C23 / gcc16
- Fix multiple memory leaks, null checks, and error checks
- Validate peer public key in DH key exchange
- Avoid remote window overflow
- Avoid off-by-one overflow during kbdint authentication
- Avoid logging uninitialized sequence numbers
- Avoid double conversion of SFTP version number
- Send correct SFTP server version number
- Avoid handling repeated SFTP INIT messages
- Harmonize return values from SFTP server callbacks
- Update %suse_version checks for SLES 16.x (jsc#PED-15815)