p PatchFirst

CVE-2016-3115

CVE-2016-3115

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

CVSS 6.4 · Medium · EPSS 35.5% · Public exploit · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • openssh Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-1

    Update to 1:7.2p2-1

  • openssh Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-1

    Update to 1:7.2p2-1

  • openssh Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-1

    Update to 1:7.2p2-1

  • openssh Ubuntu:14.04:LTS

    Versions
    • 1:6.2p2-6
    • 1:6.2p2-6ubuntu1
    • 1:6.4p1-1
    • 1:6.4p1-2
    • 1:6.5p1-1
    • 1:6.5p1-2
    • 1:6.5p1-3
    • 1:6.5p1-4
    • 1:6.5p1-6
    • 1:6.6p1-1
    • 1:6.6p1-2
    • 1:6.6p1-2ubuntu1
    • 1:6.6p1-2ubuntu2
    • 1:6.6p1-2ubuntu2.2
    • 1:6.6p1-2ubuntu2.3
    • 1:6.6p1-2ubuntu2.4
    • 1:6.6p1-2ubuntu2.6
    Affected ranges
    • ECOSYSTEM: < 1:6.6p1-2ubuntu2.7

    Update to 1:6.6p1-2ubuntu2.7

Original sources

Check your server →