Description
The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:7.1p2-1 | — |
| Debian 13 | openssh | 1:7.1p2-1 | — |
| Debian 12 | openssh | 1:7.1p2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssh | 1:6.6p1-2ubuntu2.7 | USN-2966-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.2 | openssh | 6.8_p1-r10 | — |
Advisories 4
- USN-2966-1 openssh vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- WID-SEC-2024-1055 OpenSSH: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 13, 2024
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
References
- 81293 vdb-entry
- FEDORA-2016-4556904561 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
- FEDORA-2016-c330264861 vendor-advisory
- http://www.openssh.com/txt/release-7.1p2
- FEDORA-2016-2e89eba0c1 vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa109
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
- https://anongit.mindrot.org/openssh.git/commit/?id=2fecfd486bdba9f51b3a789277bb0733ca36e1c0
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf