Description
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:7.1p2-1 | — |
| Debian 13 | openssh | 1:7.1p2-1 | — |
| Debian 12 | openssh | 1:7.1p2-1 | — |
| Debian 8 | openssh | 1:6.7p1-5+deb8u1 | DSA-3446-1 |
| Debian 7 | openssh | 1:6.0p1-4+deb7u3 | DSA-3446-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openssh | 1:5.5p1-6+squeeze8 | DLA-387-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssh | 1:6.6p1-2ubuntu2.4 | USN-2869-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssh +6 | 6.6.1p1-23.el7_2 | RHSA-2016:0043 |
| RHEL 7 | pam_ssh_agent_auth | 0.9.3-9.23.el7_2 | RHSA-2016:0043 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES 12 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES 11 SP4 | openssh | 6.6p1-16.1 | SUSE-SU-2016:0120-1 |
| SLES 11 SP4 | openssh-askpass-gnome | 6.6p1-16.4 | SUSE-SU-2016:0120-1 |
| SLES 11 SP3 | openssh | 6.2p2-0.24.1 | SUSE-SU-2016:0119-1 |
| SLES 11 SP3 | openssh-askpass-gnome | 6.2p2-0.24.3 | SUSE-SU-2016:0119-1 |
| SLES 11 | openssh-openssl1 | 6.6p1-10.1 | SUSE-SU-2016:0117-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES for SAP 12 | openssh +1 | 6.6p1-33.1 | SUSE-SU-2016:0118-1 |
| SLES for SAP 11 SP4 | openssh | 6.6p1-16.1 | SUSE-SU-2016:0120-1 |
| SLES for SAP 11 SP4 | openssh-askpass-gnome | 6.6p1-16.4 | SUSE-SU-2016:0120-1 |
| SLES for SAP 11 SP3 | openssh | 6.2p2-0.24.1 | SUSE-SU-2016:0119-1 |
| SLES for SAP 11 SP3 | openssh-askpass-gnome | 6.2p2-0.24.3 | SUSE-SU-2016:0119-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssh | 7.2p2-3.1 | openSUSE-SU-2024:10174-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssh +6 | 6.6.1p1-23.el7_2 | ELSA-2016-0043 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.9.3-9.23.el7_2 | ELSA-2016-0043 |
Advisories 13
- RHSA-2016:0043 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2869-1 openssh vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- DSA-3446-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-387-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10174-1 openssh-7.2p2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0117-1 Security update for openssh-openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0120-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0118-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0119-1 Security update for openssh SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1055 OpenSSH: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 13, 2024
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
- ELSA-2016-0043 Moderate: openssh security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 14, 2016
References
- https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/
- SUSE-SU-2016:0117 vendor-advisory
- https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/
- APPLE-SA-2016-03-21-5 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375
- 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list
- https://support.apple.com/HT206167
- FEDORA-2016-4556904561 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.openssh.com/txt/release-7.1p2
- openSUSE-SU-2016:0128 vendor-advisory
- 80698 vdb-entry
- FEDORA-2016-2e89eba0c1 vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa109
- 1034671 vdb-entry
- openSUSE-SU-2016:0127 vendor-advisory
- GLSA-201601-01 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- [oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list
- 20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list
- SUSE-SU-2016:0119 vendor-advisory
- http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html
- SUSE-SU-2016:0118 vendor-advisory
- SUSE-SU-2016:0120 vendor-advisory
- USN-2869-1 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- DSA-3446 vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf