A libssh2 security update has been released for Debian GNU/Linux 8 LTS

Package : libssh2
Version : 1.4.3-4.1+deb8u6
CVE ID : CVE-2019-17498
Debian Bug : 943562

In libssh2, SSH_MSG_DISCONNECT logic in packet.c has an integer
overflow in a bounds check, enabling an attacker to specify an
arbitrary (out-of-bounds) offset for a subsequent memory read. A
crafted SSH server may be able to disclose sensitive information or
cause a denial of service condition on the client system when a user
connects to the server

For Debian 8 "Jessie", this problem has been fixed in version
1.4.3-4.1+deb8u6.

We recommend that you upgrade your libssh2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS