3 files changed, 22 insertions, 16 deletions

diff --git a/debian/changelog b/debian/changelog
index a7359c9c5..066a762c9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,16 +1,22 @@
-openssh (1:6.3p1-1) UNRELEASED; urgency=low
-
-  * New upstream release (http://www.openssh.com/txt/release-6.3).
-    - sftp(1): add support for resuming partial downloads using the "reget"
-      command and on the sftp commandline or on the "get" commandline using
-      the "-a" (append) option (closes: #158590).
-    - ssh(1): add an "IgnoreUnknown" configuration option to selectively
-      suppress errors arising from unknown configuration directives (closes:
-      #436052).
-    - sftp(1): update progressmeter when data is acknowledged, not when it's
-      sent (partially addresses #708372).
-    - ssh(1): do not fatally exit when attempting to cleanup multiplexing-
-      created channels that are incompletely opened (closes: #651357).
+openssh (1:6.4p1-1) UNRELEASED; urgency=low
+
+  * New upstream release.  Important changes:
+    - 6.3/6.3p1 (http://www.openssh.com/txt/release-6.3):
+      + sftp(1): add support for resuming partial downloads using the
+        "reget" command and on the sftp commandline or on the "get"
+        commandline using the "-a" (append) option (closes: #158590).
+      + ssh(1): add an "IgnoreUnknown" configuration option to selectively
+        suppress errors arising from unknown configuration directives
+        (closes: #436052).
+      + sftp(1): update progressmeter when data is acknowledged, not when
+        it's sent (partially addresses #708372).
+      + ssh(1): do not fatally exit when attempting to cleanup multiplexing-
+        created channels that are incompletely opened (closes: #651357).
+    - 6.4/6.4p1 (http://www.openssh.com/txt/release-6.4):
+      + sshd(8): fix a memory corruption problem triggered during rekeying
+        when an AES-GCM cipher is selected (closes: #729029).  Full details
+        of the vulnerability are available at:
+        http://www.openssh.com/txt/gcmrekey.adv
   * When running under Upstart, only consider the daemon started once it is
     ready to accept connections (by raising SIGSTOP at that point and using
     "expect stop").
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index 85c6722f0..b9221f94f 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -13,7 +13,7 @@ Description: GSSAPI key exchange support
  security history.
 Author: Simon Wilkinson <simon@sxw.org.uk>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2013-09-14
+Last-Updated: 2013-11-09
 
 Index: b/ChangeLog.gssapi
 ===================================================================
@@ -475,7 +475,7 @@ Index: b/gss-genr.c
 --- a/gss-genr.c
 +++ b/gss-genr.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: gss-genr.c,v 1.21 2013/05/17 00:13:13 djm Exp $ */
+ /* $OpenBSD: gss-genr.c,v 1.22 2013/11/08 00:39:15 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 2be45ebf8..392afc073 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -42,7 +42,7 @@ Index: b/version.h
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
- #define SSH_VERSION    "OpenSSH_6.3"
+ #define SSH_VERSION    "OpenSSH_6.4"
  
  #define SSH_PORTABLE   "p1"
 -#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE