Debian Dropbear vulnerabilities

CVE-2025-47203 [MEDIUM] CVE-2025-47203: dropbear - dbclient in Dropbear SSH before 2025.88 allows command injection via an untruste... dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used. Scope: local bookworm: resolved (fixed in 2022.83-1+deb12u3) bullseye: resolved (fixed in 2020.81-3+deb11u3) forky: resolved (fixed in 2025.88-1) sid: resolved (fixed in 2025.88-1) trixie: resolved (fixed in 2025.88-1)

CVE-2016-7409 [MEDIUM] CVE-2016-7409: dropbear - The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG... The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident. Scope: local bookworm: resolved (fixed in 2016.74-1) bullseye: resolved (fixed in 2016.74-1) forky: resolved (fixed in 2016.74-1) sid: resolved (fixed in 2016.74-1) trixie: resolved

CVE-2017-9079 [MEDIUM] CVE-2017-9079: dropbear - Dropbear before 2017.75 might allow local users to read certain files as root, i... Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed. Scope: local bookworm: resolved (fixed in 2016.74-5) bullseye: resolved (fixed in 2016.74-5) forky: resolved (fixed i