CVE-2016-0778

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

Affected products

Alt Linux, Centos, Ibm Aix, Junos, Openssh, Red Hat, Suse, Ubuntu

Oracle Linux

= 7

Oracle Solaris

= 11.3

Fix

Available

CVSS 3.0

8.1 HIGH

EPSS

20.9% (97th percentile)

Weakness

CWE-119

NVD status

Modified

Published

2016-01-14