Description
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:7.1p2-1 | — |
| Debian 13 | openssh | 1:7.1p2-1 | — |
| Debian 12 | openssh | 1:7.1p2-1 | — |
| Debian 8 | openssh | 1:6.7p1-5+deb8u1 | DSA-3446-1 |
| Debian 7 | openssh | 1:6.0p1-4+deb7u3 | DSA-3446-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openssh | 1:5.5p1-6+squeeze8 | DLA-387-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssh | 1:6.6p1-2ubuntu2.4 | USN-2869-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssh +6 | 6.6.1p1-23.el7_2 | RHSA-2016:0043 |
| RHEL 7 | pam_ssh_agent_auth | 0.9.3-9.23.el7_2 | RHSA-2016:0043 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES 12 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES 11 SP4 | openssh | 6.6p1-16.1 | SUSE-SU-2016:0120-1 |
| SLES 11 SP4 | openssh-askpass-gnome | 6.6p1-16.4 | SUSE-SU-2016:0120-1 |
| SLES 11 SP3 | openssh | 6.2p2-0.24.1 | SUSE-SU-2016:0119-1 |
| SLES 11 SP3 | openssh-askpass-gnome | 6.2p2-0.24.3 | SUSE-SU-2016:0119-1 |
| SLES 11 | openssh-openssl1 | 6.6p1-10.1 | SUSE-SU-2016:0117-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES for SAP 12 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES for SAP 11 SP4 | openssh | 6.6p1-16.1 | SUSE-SU-2016:0120-1 |
| SLES for SAP 11 SP4 | openssh-askpass-gnome | 6.6p1-16.4 | SUSE-SU-2016:0120-1 |
| SLES for SAP 11 SP3 | openssh | 6.2p2-0.24.1 | SUSE-SU-2016:0119-1 |
| SLES for SAP 11 SP3 | openssh-askpass-gnome | 6.2p2-0.24.3 | SUSE-SU-2016:0119-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssh | 7.2p2-3.1 | openSUSE-SU-2024:10174-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssh +6 | 6.6.1p1-23.el7_2 | ELSA-2016-0043 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.9.3-9.23.el7_2 | ELSA-2016-0043 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
Abdirisaq-ali-aynab/vulnerability-assessment ★ 0 · Nov 11, 2025
Professional cybersecurity assessment demonstrating vulnerability identification, CVSS severity scoring, MITRE ATT&CK framework application, and detailed remediation planning for OpenSSH 6.6.1p1 crit…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 13
- RHSA-2016:0043 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2869-1 openssh vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- DSA-3446-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-387-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10174-1 openssh-7.2p2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0117-1 Security update for openssh-openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0120-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0118-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0119-1 Security update for openssh SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1055 OpenSSH: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 13, 2024
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
- ELSA-2016-0043 Moderate: openssh security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 14, 2016
References
- https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/
- SUSE-SU-2016:0117 vendor-advisory
- https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/
- APPLE-SA-2016-03-21-5 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375
- 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list
- https://support.apple.com/HT206167
- FEDORA-2016-4556904561 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734
- 80695 vdb-entry
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
- FreeBSD-SA-16:07 vendor-advisory
- FEDORA-2016-c330264861 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.openssh.com/txt/release-7.1p2
- openSUSE-SU-2016:0128 vendor-advisory
- FEDORA-2016-2e89eba0c1 vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa109
- 1034671 vdb-entry
- openSUSE-SU-2016:0127 vendor-advisory
- GLSA-201601-01 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- [oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list
- 20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list
- SUSE-SU-2016:0119 vendor-advisory
- http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html
- SUSE-SU-2016:0118 vendor-advisory
- FEDORA-2016-67c6ef0d4f vendor-advisory
- SUSE-SU-2016:0120 vendor-advisory
- USN-2869-1 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- DSA-3446 vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf