Skip to content
OpenAdvisories
Medium ELSA-2016-0043 2 CVEs

Moderate: openssh security update (Oracle Linux 7)

Published Jan 14, 2016 · Updated Jan 14, 2016

Ecosystem: Oracle Linux

Summary

[6.6.1p1-23 + 0.9.3-9]
- Disable undocumented feauture Roaming for good (#1298218)
- prevents CVE-2016-0777 and CVE-2016-0778

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 7 openssh 0:6.6.1p1-23.el7_2
Oracle Linux · 7 openssh-askpass 0:6.6.1p1-23.el7_2
Oracle Linux · 7 openssh-clients 0:6.6.1p1-23.el7_2
Oracle Linux · 7 openssh-keycat 0:6.6.1p1-23.el7_2
Oracle Linux · 7 openssh-ldap 0:6.6.1p1-23.el7_2
Oracle Linux · 7 openssh-server 0:6.6.1p1-23.el7_2
Oracle Linux · 7 openssh-server-sysvinit 0:6.6.1p1-23.el7_2
Oracle Linux · 7 pam_ssh_agent_auth 0:0.9.3-9.23.el7_2

Vulnerabilities 2

  • High 8.1
    CVE-2016-0778 EPSS 21%

    The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x bef…

    openssh openssh Debian Ubuntu
  • Medium 6.5
    CVE-2016-0777 Public exploit EPSS 63%

    The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote ser…

    openssh openssh Debian Ubuntu