CVE-2016-10012 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Openssh
Severity
7.8HIGHNVD
EPSS
0.0%
top 94.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 5
Latest updateApr 5
Description
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages4 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-f4jf-rwp2-rx83: The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7↗2022-05-14
OSV▶
CVE-2016-10012: The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7↗2017-01-05
CVEList▶
CVE-2016-10012: The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7↗2017-01-05