CVE-2016-0778 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Openssh
Severity
8.1HIGHNVD
EPSS
2.0%
top 16.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 14
Latest updateMay 13
Description
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9
Affected Packages8 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-cqpr-rfm2-cchc: The (1) roaming_read and (2) roaming_write functions in roaming_common↗2022-05-13
CVEList
▶
OSV
▶
📋Vendor Advisories
5Debian▶
CVE-2016-0778: openssh - The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the ...↗2016
💬Community
4Bugzilla▶
CVE-2016-0778 OpenSSH: Client buffer-overflow when using roaming connections [fedora-all]↗2016-01-14