openssh buffer_append_space vulnerability

[Joseph Blade <jblade27 () comcast net>]

Good Morning To All,

Long time listener, first time caller.

Has anyone in the community seen any progress in the
buffer_append_space() vulnerability,  which sets the buffer's
allocated int when it isn't allocated?

The last process that I used last September was to use data compression
to crash buffer_append().  When this was done, the data would cause a
crash before the space was allocated.  At that point I had "deer in the
headlights"

If anyone has any ideas or knows of a poc in regards to this
vulnerability, I would greatly appreciate it.  

Regards,

jb