Skip to content
OpenAdvisories
Medium ELSA-2016-0465 2 CVEs

Moderate: openssh security update (Oracle Linux 7)

Published Mar 21, 2016 · Updated Mar 21, 2016

Ecosystem: Oracle Linux

Summary

[6.6.1p1-25 + 0.9.3-9]
- CVE-2016-1908: possible fallback from untrusted to trusted X11 forwarding (#1298741)

[6.6.1p1-24 + 0.9.3-9]
- CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317818)

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 7 openssh 0:6.6.1p1-25.el7_2
Oracle Linux · 7 openssh-askpass 0:6.6.1p1-25.el7_2
Oracle Linux · 7 openssh-clients 0:6.6.1p1-25.el7_2
Oracle Linux · 7 openssh-keycat 0:6.6.1p1-25.el7_2
Oracle Linux · 7 openssh-ldap 0:6.6.1p1-25.el7_2
Oracle Linux · 7 openssh-server 0:6.6.1p1-25.el7_2
Oracle Linux · 7 openssh-server-sysvinit 0:6.6.1p1-25.el7_2
Oracle Linux · 7 pam_ssh_agent_auth 0:0.9.3-9.25.el7_2

Vulnerabilities 2

  • Critical 9.8
    CVE-2016-1908 EPSS 14%

    The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the loc…

    openssh openssh Debian Ubuntu
  • Medium 6.4
    CVE-2016-3115 Public exploit EPSS 36%

    Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users t…

    openssh openssh Debian Ubuntu