Red Hat Security Advisory: openssh security, bug fix, and enhancement update

Fixed packages 28

Vulnerabilities 4

• Critical 9.8
  CVE-2016-1908 EPSS 14%

  The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the loc…

  openssh openssh Debian Ubuntu
  Apr 11, 2017
• High 7.0
  CVE-2015-6564

  Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-O…

  openssh openssh Debian Ubuntu
  Aug 24, 2015
• Medium 6.4
  CVE-2015-6563

  The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITO…

  openssh openssh Debian Ubuntu
  Aug 24, 2015
• Unscored —
  CVE-2015-5352

  The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks…

  openssh openssh Debian Ubuntu
  Aug 3, 2015

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Release_Notes/index.html
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Technical_Notes/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1211673
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1218070
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1219820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1238231
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1252844
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1252852
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1298741
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0741.json
• report
  https://access.redhat.com/security/cve/CVE-2015-5352
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-5352
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-5352
• article
  https://thejh.net/written-stuff/openssh-6.8-xsecurity
• report
  https://access.redhat.com/security/cve/CVE-2015-6563
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-6563
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-6563
• article
  http://www.openssh.com/txt/release-7.0
• report
  https://access.redhat.com/security/cve/CVE-2015-6564
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-6564
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-6564
• report
  https://access.redhat.com/security/cve/CVE-2016-1908
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-1908
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-1908