CVE-2007-4752
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and...
CVE-2007-4752 is a high vulnerability (CVSS 7.5) in Openbsd Openssh, published September 12, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in openssh 1:4.7p1-1.
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
Exploit likelihood
What each source reports
NVD Score used
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
- Record
CVE-2007-4752- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
- Record
CVE-2007-4752- Updated
- 2026-11-02
EUVDEUVD-2007-4733 No score
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
- Record
EUVD-2007-4733- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-657x-xg3w-fxx6 No score
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and...
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
- Record
GHSA-657x-xg3w-fxx6- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
- Record
CVE-2007-4752- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4752 No score
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
- Record
DEBIAN-CVE-2007-4752- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11124-1 No score
openssh-8.4p1-7.4 on GA media
These are all security issues fixed in the openssh-8.4p1-7.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11124-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensshDebian:12 |
before 1:4.7p1-1 | 1:4.7p1-1 |
opensshDebian:13 |
before 1:4.7p1-1 | 1:4.7p1-1 |
opensshDebian:14 |
before 1:4.7p1-1 | 1:4.7p1-1 |
opensshDebian:4.0 |
before 1:4.3p2-9etch2, plus listed versions 1:4.3p2-91:4.3p2-9etch1 |
1:4.3p2-9etch2 |
opensshRed Hat:rhel_eus:4.5::as |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-askpassRed Hat:rhel_eus:4.5::as |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-askpass-gnomeRed Hat:rhel_eus:4.5::as |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-clientsRed Hat:rhel_eus:4.5::as |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-debuginfoRed Hat:rhel_eus:4.5::as |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-serverRed Hat:rhel_eus:4.5::as |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensshRed Hat:enterprise_linux:4::as |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpassRed Hat:enterprise_linux:4::as |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::as |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-clientsRed Hat:enterprise_linux:4::as |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-serverRed Hat:enterprise_linux:4::as |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
opensshRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpassRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-clientsRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-serverRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
opensshRed Hat:rhel_eus:4.5::es |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-askpassRed Hat:rhel_eus:4.5::es |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-askpass-gnomeRed Hat:rhel_eus:4.5::es |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-clientsRed Hat:rhel_eus:4.5::es |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-debuginfoRed Hat:rhel_eus:4.5::es |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
openssh-serverRed Hat:rhel_eus:4.5::es |
before 0:3.9p1-10.RHEL4.20 | 0:3.9p1-10.RHEL4.20 |
opensshRed Hat:enterprise_linux:4::es |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpassRed Hat:enterprise_linux:4::es |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::es |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-clientsRed Hat:enterprise_linux:4::es |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-serverRed Hat:enterprise_linux:4::es |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
opensshRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpassRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-clientsRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
openssh-serverRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-11.el4_7 | 0:3.9p1-11.el4_7 |
opensshRed Hat:enterprise_linux:5::client |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-askpassRed Hat:enterprise_linux:5::client |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-clientsRed Hat:enterprise_linux:5::client |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-debuginfoRed Hat:enterprise_linux:5::client |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-serverRed Hat:enterprise_linux:5::client |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
opensshRed Hat:enterprise_linux:5::server |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-askpassRed Hat:enterprise_linux:5::server |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-clientsRed Hat:enterprise_linux:5::server |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-debuginfoRed Hat:enterprise_linux:5::server |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
openssh-serverRed Hat:enterprise_linux:5::server |
before 0:4.3p2-26.el5_2.1 | 0:4.3p2-26.el5_2.1 |
opensshopenSUSE:Tumbleweed |
before 8.4p1-7.4 | 8.4p1-7.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | aliases | |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
openssh.com/txt/release-4.7
security.gentoo.org/glsa/glsa-200711-02.xml
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809
debian.org/security/2008/dsa-1576
securityfocus.com/bid/25628
Show 50 moreShow less
support.avaya.com/elmodocs2/security/ASA-2008-399.htm
redhat.com/archives/fedora-package-announce/2007-October/msg00214.html
ubuntu.com/usn/usn-566-1
securityreason.com/securityalert/3126
vupen.com/english/advisories/2008/0924/references
secunia.com/advisories/30249
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085
mandriva.com/security/advisories?name=MDKSA-2007:236
bugzilla.redhat.com/show_bug.cgi?id=280471
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
exchange.xforce.ibmcloud.com/vulnerabilities/36637
issues.rpath.com/browse/RPL-1706
docs.info.apple.com/article.html?artnum=307562
bugs.gentoo.org/show_bug.cgi?id=191321
lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
nvd.nist.gov/vuln/detail/CVE-2007-4752
github.com/advisories/GHSA-657x-xg3w-fxx6
security-tracker.debian.org/tracker/CVE-2007-4752
access.redhat.com/errata/RHSA-2008:0855
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0855.json
cve.org/CVERecord?id=CVE-2007-4752
suse.com/security/cve/CVE-2006-0225