A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
Credits
Red Hat would like to thank Halil Oktay (oblivionsage) for reporting this issue.
