Description
Buffer overflow in Dropbear server before 0.47 allows authenticated users to execute arbitrary code via unspecified inputs that cause insufficient memory to be allocated due to an incorrect expression that does not enforce the proper order of operations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dropbear | 0.47-1 | — |
| Debian 13 | dropbear | 0.47-1 | — |
| Debian 12 | dropbear | 0.47-1 | — |
| Debian 3.1 | dropbear | 0.45-2sarge0 | DSA-923-1 |
Advisories 1
- DSA-923-1 dropbear - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 18142 third-party-advisory
- 15923 vdb-entry
- [dropbear] 20051211 Dropbear 0.47 (and security fix) mailing-list
- 18109 third-party-advisory
- GLSA-200512-13 vendor-advisory
- DSA-923 vendor-advisory
- 18108 third-party-advisory
- http://matt.ucc.asn.au/dropbear/dropbear.html
- ADV-2005-2962 vdb-entry