CVE-2017-9078 — Double Free in SSH Project Dropbear SSH

CWE-415 — Double Free7 documents5 sources
Severity
8.8HIGHNVD
EPSS
5.2%
top 10.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Dropbear SSH Project Dropbear SSHDebian DropbearDebian Linux
Timeline
PublishedMay 19
Latest updateMay 13

Description

The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/dropbear< dropbear 2016.74-5 (bookworm)
▶Debiandropbear_ssh_project/dropbear_ssh< 2016.74-5+3

Also affects: Debian Linux 8.0

Patches

Patch: lists.ucc.gu.uwa.edu.au ↗Patch: lists.ucc.gu.uwa.edu.au ↗

🔴Vulnerability Details

2
GHSA
GHSA-p8gj-w7rh-3g6f: The server in Dropbear before 2017↗2022-05-13
▶
OSV
CVE-2017-9078: The server in Dropbear before 2017↗2017-05-19
▶

📋Vendor Advisories

1
Debian
CVE-2017-9078: dropbear - The server in Dropbear before 2017.75 might allow post-authentication root remot...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-9078 CVE-2017-9079 dropbear: Multiple vulnerabilities fixed in 2017.75 version↗2017-05-19
▶
Bugzilla
CVE-2017-9078 CVE-2017-9079 dropbear: Multiple vulnerabilities fixed in 2017.75 version [fedora-all]↗2017-05-19
▶
Bugzilla
CVE-2017-9078 CVE-2017-9079 dropbear: Multiple vulnerabilities fixed in 2017.75 version [epel-all]↗2017-05-19
▶