commit d6139ee6bbf3bda83ebefc73d8079d0897488d1d
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Tue Jan 12 17:14:33 2016 -0800

    disable roaming in ssh client
    
    SSH roaming implementation in openssh client is vulnerable to an
    information leak (CVE-2016-0777) and heap-based buffer overflow
    (CVE-2016-0778). The information leak is somehow attacker-controller,
    and it is for example possible to extract the ssh client private keys.

--- a/readconf.c
+++ b/readconf.c
@@ -1246,7 +1246,7 @@ initialize_options(Options * options)
 	options->tun_remote = -1;
 	options->local_command = NULL;
 	options->permit_local_command = -1;
-	options->use_roaming = -1;
+	options->use_roaming = 0;
 	options->visual_host_key = -1;
 	options->zero_knowledge_password_authentication = -1;
 	options->ip_qos_interactive = -1;
@@ -1417,8 +1417,7 @@ fill_default_options(Options * options)
 		options->tun_remote = SSH_TUNID_ANY;
 	if (options->permit_local_command == -1)
 		options->permit_local_command = 0;
-	if (options->use_roaming == -1)
-		options->use_roaming = 1;
+	options->use_roaming = 0;
 	if (options->visual_host_key == -1)
 		options->visual_host_key = 0;
 	if (options->zero_knowledge_password_authentication == -1)
