Description
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:7.2p1-1 | — |
| Debian 13 | openssh | 1:7.2p1-1 | — |
| Debian 12 | openssh | 1:7.2p1-1 | — |
| Debian 8 | openssh | 1:6.7p1-5+deb8u6 | DLA-1500-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssh | 1:6.6p1-2ubuntu2.7 | USN-2966-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssh +6 | 6.6.1p1-25.el7_2 | RHSA-2016:0465 |
| RHEL 7 | pam_ssh_agent_auth | 0.9.3-9.25.el7_2 | RHSA-2016:0465 |
| RHEL 6 | openssh +4 | 5.3p1-117.el6 | RHSA-2016:0741 |
| RHEL 6 | pam_ssh_agent_auth | 0.9.3-117.el6 | RHSA-2016:0741 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | openssh +1 | 6.6p1-42.1 | SUSE-SU-2016:1386-1 |
| SLES 12 | openssh +1 | 6.6p1-42.1 | SUSE-SU-2016:1386-1 |
| SLES 11 SP4 | openssh | 6.6p1-21.1 | SUSE-SU-2016:1528-1 |
| SLES 11 SP4 | openssh-askpass-gnome | 6.6p1-21.3 | SUSE-SU-2016:1528-1 |
| SLES 11 SP3 | openssh | 6.2p2-0.33.2 | SUSE-SU-2016:2388-1 |
| SLES 11 SP3 | openssh-askpass-gnome | 6.2p2-0.33.5 | SUSE-SU-2016:2388-1 |
| SLES 11 | openssh-openssl1 | 6.6p1-15.1 | SUSE-SU-2016:2555-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | openssh +1 | 6.6p1-42.1 | SUSE-SU-2016:1386-1 |
| SLES for SAP 12 | openssh +1 | 6.6p1-42.1 | SUSE-SU-2016:1386-1 |
| SLES for SAP 11 SP4 | openssh | 6.6p1-21.1 | SUSE-SU-2016:1528-1 |
| SLES for SAP 11 SP4 | openssh-askpass-gnome | 6.6p1-21.3 | SUSE-SU-2016:1528-1 |
| SUSE OpenStack Cloud 5 | openssh | 6.2p2-0.33.2 | SUSE-SU-2016:2388-1 |
| SUSE OpenStack Cloud 5 | openssh-askpass-gnome | 6.2p2-0.33.5 | SUSE-SU-2016:2388-1 |
| SUSE Manager Proxy 2.1 | openssh | 6.2p2-0.33.2 | SUSE-SU-2016:2388-1 |
| SUSE Manager Proxy 2.1 | openssh-askpass-gnome | 6.2p2-0.33.5 | SUSE-SU-2016:2388-1 |
| SUSE Manager 2.1 | openssh | 6.2p2-0.33.2 | SUSE-SU-2016:2388-1 |
| SUSE Manager 2.1 | openssh-askpass-gnome | 6.2p2-0.33.5 | SUSE-SU-2016:2388-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssh | 6.2p2-0.33.2 | SUSE-SU-2016:2388-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssh-askpass-gnome | 6.2p2-0.33.5 | SUSE-SU-2016:2388-1 |
Advisories 10
- RHSA-2016:0465 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2016:0741 Red Hat Security Advisory: openssh security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2966-1 openssh vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- DLA-1500-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:1528-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2555-1 Security update for openssh-openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2388-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1386-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
References
- http://www.openssh.com/txt/release-7.2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
- [oss-security] 20160115 Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list
- 1034705 vdb-entry
- RHSA-2016:0741 vendor-advisory
- GLSA-201612-18 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1298741
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update mailing-list
- 84427 vdb-entry
- RHSA-2016:0465 vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf