dropbear: command injection

A vulnerability was found in a way dropbear processed X11 forwarding
input. By using a specially crafted request, an attacker could bypass
the authorized_keys command restrictions.

xauth is run under the user’s privilege, so this vulnerability offers no
additional access to unrestricted accounts, but could circumvent key or
account restrictions such as sshd_config ForceCommand, authorized_keys
command="…" or restricted shells.