Description
A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 4
- DSA-382-1 ssh - possible remote vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-382-2 ssh - possible remote vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-382-3 ssh - possible remote vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-383 ssh-krb5 - possible remote vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1000620 vendor-advisory
- 20030915 new ssh exploit? mailing-list
- 20030917 [OpenPKG-SA-2003.040] OpenPKG Security Advisory (openssh) mailing-list
- openssh-packet-bo(13191) vdb-entry
- DSA-383 vendor-advisory
- 20030916 [slackware-security] OpenSSH Security Advisory (SSA:2003-259-01) mailing-list
- http://www.openssh.com/txt/buffer.adv
- RHSA-2003:280 vendor-advisory
- CA-2003-24 third-party-advisory
- 20030915 openssh remote exploit mailing-list
- oval:org.mitre.oval:def:2719 vdb-entry signature
- 2003-0033 vendor-advisory
- 20030916 The lowdown on SSH vulnerability mailing-list
- DSA-382 vendor-advisory
- 20030916 OpenSSH Buffer Management Bug Advisory mailing-list
- MDKSA-2003:090 vendor-advisory
- oval:org.mitre.oval:def:447 vdb-entry signature
- RHSA-2003:279 vendor-advisory
- VU#333628 third-party-advisory
- [oss-security] 20240701 CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems mailing-list