CVE-2016-7406
CVE-2016-7406
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
CVSS 9.8 · Critical · EPSS 10.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
dropbear Debian:12
- Affected ranges
- ECOSYSTEM: < 2016.74-1
Update to 2016.74-1
dropbear Debian:13
- Affected ranges
- ECOSYSTEM: < 2016.74-1
Update to 2016.74-1
dropbear Debian:14
- Affected ranges
- ECOSYSTEM: < 2016.74-1
Update to 2016.74-1
dropbear Ubuntu:16.04:LTS
- Versions
- 2014.65-1ubuntu2
- 2015.68-1
- 2015.70-1
- 2015.71-1
- 2016.72-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://security.gentoo.org/glsa/201702-23
- http://www.securityfocus.com/bid/92974
- http://www.openwall.com/lists/oss-security/2016/09/15/2
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb
- http://seclists.org/fulldisclosure/2024/Aug/35
- https://nvd.nist.gov/vuln/detail/CVE-2016-7406