{"id":"CVE-2016-1908","aliases":["DEBIAN-CVE-2016-1908","DLA-1500-1","EUVD-2016-2999","GHSA-mgwc-m57j-46w8","RHSA-2016:0465","RHSA-2016:0741","SUSE-SU-2016:1386-1","SUSE-SU-2016:1528-1","SUSE-SU-2016:2388-1","SUSE-SU-2016:2555-1","UBUNTU-CVE-2016-1908","USN-2966-1"],"status":"published","title":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding...","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-04","score":0.13736,"percentile":0.96518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2016-01-15T00:00:00Z","modified":"2026-09-22T07:01:00.219641143Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.7p1-5+deb8u6"}]}],"versions":["1:6.7p1-5","1:6.7p1-5+deb8u1","1:6.7p1-5+deb8u2","1:6.7p1-5+deb8u3","1:6.7p1-5+deb8u4","1:6.7p1-5+deb8u5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-9.25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-9.25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-9.25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1p1-25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-9.25.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-117.el6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-21.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-21.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openssh-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-15.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.7"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.7"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openbsd","product":"openssh"},{"vendor":"oracle","product":"linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://www.openssh.com/txt/release-7.2","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://openwall.com/lists/oss-security/2016/01/15/13","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1034705","tags":["vdb-entry","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201612-18","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/84427","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1908","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mgwc-m57j-46w8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1908","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0465","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316829","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0465.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1908","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3115","tags":["advisory"]},{"url":"http://www.openssh.com/txt/x11fwd.adv","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0741","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Release_Notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Technical_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1238231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1252844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1252852","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0741.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5352","tags":["advisory"]},{"url":"https://thejh.net/written-stuff/openssh-6.8-xsecurity","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6563","tags":["advisory"]},{"url":"http://www.openssh.com/txt/release-7.0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6564","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/729190","tags":["report"]},{"url":"https://bugzilla.suse.com/932483","tags":["report"]},{"url":"https://bugzilla.suse.com/945484","tags":["report"]},{"url":"https://bugzilla.suse.com/945493","tags":["report"]},{"url":"https://bugzilla.suse.com/947458","tags":["report"]},{"url":"https://bugzilla.suse.com/948902","tags":["report"]},{"url":"https://bugzilla.suse.com/960414","tags":["report"]},{"url":"https://bugzilla.suse.com/961368","tags":["report"]},{"url":"https://bugzilla.suse.com/962313","tags":["report"]},{"url":"https://bugzilla.suse.com/965576","tags":["report"]},{"url":"https://bugzilla.suse.com/970632","tags":["report"]},{"url":"https://bugzilla.suse.com/975865","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161528-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/961494","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162388-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/959096","tags":["report"]},{"url":"https://bugzilla.suse.com/962794","tags":["report"]},{"url":"https://bugzilla.suse.com/981654","tags":["report"]},{"url":"https://bugzilla.suse.com/989363","tags":["report"]},{"url":"https://bugzilla.suse.com/992533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162555-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1908","tags":["report"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034684.html","tags":["report"]},{"url":"http://seclists.org/oss-sec/2016/q1/115","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2966-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3115","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1908","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","status":"published","published":"2017-04-11T00:00:00Z","modified":"2026-05-29T20:14:45.314Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"references":[{"url":"http://www.openssh.com/txt/release-7.2"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c"},{"url":"http://openwall.com/lists/oss-security/2016/01/15/13","tags":["mailing-list"]},{"url":"http://www.securitytracker.com/id/1034705","tags":["vdb-entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/201612-18","tags":["vendor-advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["mailing-list"]},{"url":"http://www.securityfocus.com/bid/84427","tags":["vdb-entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html","tags":["vendor-advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"},{"url":"http://www.openssh.com/txt/release-7.2","tags":["x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_transferred"]},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c","tags":["x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2016/01/15/13","tags":["mailing-list","x_transferred"]},{"url":"http://www.securitytracker.com/id/1034705","tags":["vdb-entry","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html","tags":["vendor-advisory","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201612-18","tags":["vendor-advisory","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["mailing-list","x_transferred"]},{"url":"http://www.securityfocus.com/bid/84427","tags":["vdb-entry","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html","tags":["vendor-advisory","x_transferred"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred"]}],"updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-2999","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","status":"published","published":"2017-04-11T00:00:00Z","modified":"2026-05-29T20:14:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"references":[{"url":"http://www.openssh.com/txt/release-7.2"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c"},{"url":"http://openwall.com/lists/oss-security/2016/01/15/13"},{"url":"http://www.securitytracker.com/id/1034705"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html"},{"url":"https://security.gentoo.org/glsa/201612-18"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html"},{"url":"http://www.securityfocus.com/bid/84427"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"}],"updated_at":"2026-11-02T18:20:59.967985Z"}],"ghsa":[{"id":"GHSA-mgwc-m57j-46w8","title":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding...","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","status":"published","published":"2022-05-14T03:00:08Z","modified":"2023-01-29T05:03:30Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1908"},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html"},{"url":"https://security.gentoo.org/glsa/201612-18"},{"url":"http://openwall.com/lists/oss-security/2016/01/15/13"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html"},{"url":"http://www.openssh.com/txt/release-7.2"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"url":"http://www.securityfocus.com/bid/84427"},{"url":"http://www.securitytracker.com/id/1034705"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"},{"url":"https://github.com/advisories/GHSA-mgwc-m57j-46w8"}],"updated_at":"2026-11-02T14:45:19.964025Z"}],"nvd":[{"id":"CVE-2016-1908","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","status":"published","published":"2017-04-11T18:59:00.167Z","modified":"2026-06-17T00:42:50.45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"references":[{"url":"http://openwall.com/lists/oss-security/2016/01/15/13","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html","tags":["Third Party Advisory"]},{"url":"http://www.openssh.com/txt/release-7.2","tags":["Release Notes","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/84427","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1034705","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c","tags":["Patch","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201612-18","tags":["Third Party Advisory"]},{"url":"http://openwall.com/lists/oss-security/2016/01/15/13","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html","tags":["Third Party Advisory"]},{"url":"http://www.openssh.com/txt/release-7.2","tags":["Release Notes","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/84427","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1034705","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c","tags":["Patch","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201612-18","tags":["Third Party Advisory"]}],"products":[{"vendor":"openbsd","product":"openssh"},{"vendor":"debian","product":"debian_linux"},{"vendor":"oracle","product":"linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-1908","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","status":"published","published":"2017-04-11T18:59:00.167Z","modified":"2026-04-10T03:48:37.164693Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["web"]},{"url":"http://www.securitytracker.com/id/1034705","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["advisory"]},{"url":"https://security.gentoo.org/glsa/201612-18","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2016/01/15/13","tags":["advisory"]},{"url":"http://www.securityfocus.com/bid/84427","tags":["advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0465.html","tags":["advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0741.html","tags":["advisory"]},{"url":"http://www.openssh.com/txt/release-7.2","tags":["advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["advisory"]},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c","tags":["fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741","tags":["fix"]}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1908","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","status":"published","published":"2017-04-11T18:59:00.167Z","modified":"2026-09-22T07:01:00.219641143Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1908","tags":["advisory"]}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1908","description":"The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.","status":"published","published":"2016-01-15T00:00:00Z","modified":"2026-06-01T07:15:29.791654267Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"references":[{"url":"https://ubuntu.com/security/CVE-2016-1908","tags":["report"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034684.html","tags":["report"]},{"url":"https://thejh.net/written-stuff/openssh-6.8-xsecurity","tags":["report"]},{"url":"http://seclists.org/oss-sec/2016/q1/115","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2966-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1908","tags":["report"]}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-1500-1","title":"openssh - security update","status":"published","published":"2018-09-10T00:00:00Z","modified":"2026-03-09T01:01:44.380043Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"RHSA-2016:0465","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-15T23:18:46Z","modified":"2026-06-26T12:21:51.220172764Z","references":[{"url":"https://access.redhat.com/errata/RHSA-2016:0465","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316829","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0465.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1908","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3115","tags":["advisory"]},{"url":"http://www.openssh.com/txt/x11fwd.adv","tags":["article"]}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0741","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:56:32Z","modified":"2026-06-26T12:21:51.562476815Z","references":[{"url":"https://access.redhat.com/errata/RHSA-2016:0741","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Release_Notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Technical_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1238231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1252844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1252852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298741","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0741.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5352","tags":["advisory"]},{"url":"https://thejh.net/written-stuff/openssh-6.8-xsecurity","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6563","tags":["advisory"]},{"url":"http://www.openssh.com/txt/release-7.0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6564","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1908","tags":["advisory"]}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:1386-1","title":"Security update for openssh","description":"This update for OpenSSH fixes three security issues.\n\nThese security issues were fixed:\n- CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)\n- CVE-2016-1908: Prevent X11 SECURITY circumvention when forwarding X11 connections (bsc#962313)\n- CVE-2015-8325: Ignore PAM environment when using login (bsc#975865)\n\nThese non-security issues were fixed:\n- Fix help output of sftp (bsc#945493)\n- Restarting openssh with openssh-fips installed was not working correctly (bsc#945484)\n- Fix crashes when /proc is not available in the chroot (bsc#947458)\n- Correctly parse GSSAPI KEX algorithms (bsc#961368)\n- More verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)\n- Fix PRNG re-seeding (bsc#960414, bsc#729190)\n- Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)\n","status":"published","published":"2016-05-23T15:04:45Z","modified":"2026-02-04T02:40:57.829267Z","references":[{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/729190","tags":["report"]},{"url":"https://bugzilla.suse.com/932483","tags":["report"]},{"url":"https://bugzilla.suse.com/945484","tags":["report"]},{"url":"https://bugzilla.suse.com/945493","tags":["report"]},{"url":"https://bugzilla.suse.com/947458","tags":["report"]},{"url":"https://bugzilla.suse.com/948902","tags":["report"]},{"url":"https://bugzilla.suse.com/960414","tags":["report"]},{"url":"https://bugzilla.suse.com/961368","tags":["report"]},{"url":"https://bugzilla.suse.com/962313","tags":["report"]},{"url":"https://bugzilla.suse.com/965576","tags":["report"]},{"url":"https://bugzilla.suse.com/970632","tags":["report"]},{"url":"https://bugzilla.suse.com/975865","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3115","tags":["web"]}],"updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1528-1","title":"Security update for openssh","description":"openssh was updated to fix three security issues.\n\nThese security issues were fixed:\n- CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions  (bsc#970632).\n- CVE-2016-1908: Possible fallback from untrusted to trusted X11 forwarding (bsc#962313).\n- CVE-2015-8325: Ignore PAM environment vars when UseLogin=yes (bsc#975865).\n\nThese non-security issues were fixed:\n- Correctly parse GSSAPI KEX algorithms (bsc#961368)\n- More verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)\n- Fix PRNG re-seeding (bsc#960414, bsc#729190)\n- Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)\n- Allow empty Match blocks (bsc#961494) \n  ","status":"published","published":"2016-06-08T10:46:21Z","modified":"2026-02-04T04:05:36.702478Z","references":[{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161528-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/729190","tags":["report"]},{"url":"https://bugzilla.suse.com/932483","tags":["report"]},{"url":"https://bugzilla.suse.com/948902","tags":["report"]},{"url":"https://bugzilla.suse.com/960414","tags":["report"]},{"url":"https://bugzilla.suse.com/961368","tags":["report"]},{"url":"https://bugzilla.suse.com/961494","tags":["report"]},{"url":"https://bugzilla.suse.com/962313","tags":["report"]},{"url":"https://bugzilla.suse.com/965576","tags":["report"]},{"url":"https://bugzilla.suse.com/970632","tags":["report"]},{"url":"https://bugzilla.suse.com/975865","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3115","tags":["web"]}],"updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2388-1","title":"Security update for openssh","description":"\nThis update for OpenSSH fixes the following issues:\n\n- Prevent user enumeration through the timing of password processing.\n  (bsc#989363, CVE-2016-6210)\n- Allow lowering the DH groups parameter limit in server as well as when GSSAPI\n  key exchange is used. (bsc#948902)\n- Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115)\n- Prevent X11 SECURITY circumvention when forwarding X11 connections.\n  (bsc#962313, CVE-2016-1908)\n- Disable DH parameters under 2048 bits by default and allow lowering the limit back\n  to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902)\n- Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325)\n- Limit the accepted password length (prevents a possible denial of service).\n  (bsc#992533, CVE-2016-6515)\n- Relax version requires for the openssh-askpass sub-package. (bsc#962794)\n- Avoid complaining about unset DISPLAY variable. (bsc#981654)\n- Initialize message id to prevent connection breakups in some cases. (bsc#959096)\n","status":"published","published":"2016-09-26T15:11:06Z","modified":"2026-02-04T02:43:20.345278Z","references":[{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162388-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/932483","tags":["report"]},{"url":"https://bugzilla.suse.com/948902","tags":["report"]},{"url":"https://bugzilla.suse.com/959096","tags":["report"]},{"url":"https://bugzilla.suse.com/962313","tags":["report"]},{"url":"https://bugzilla.suse.com/962794","tags":["report"]},{"url":"https://bugzilla.suse.com/970632","tags":["report"]},{"url":"https://bugzilla.suse.com/975865","tags":["report"]},{"url":"https://bugzilla.suse.com/981654","tags":["report"]},{"url":"https://bugzilla.suse.com/989363","tags":["report"]},{"url":"https://bugzilla.suse.com/992533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6515","tags":["web"]}],"updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2555-1","title":"Security update for openssh-openssl1","description":"\nThis update for openssh-openssl1 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-6210: Prevent user enumeration through the timing of password\n  processing (bsc#989363)\n- CVE-2016-6515: limit accepted password length (prevents possible DoS)\n  (bsc#992533)\n- CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)\n- CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11\n  connections (bsc#962313)\n- CVE-2015-8325: ignore PAM environment when using login (bsc#975865)\n- Disable DH parameters under 2048 bits by default and allow\n  lowering the limit back to the RFC 4419 specified minimum\n  through an option (bsc#932483, bsc#948902)\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n\nBugs fixed:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n- Correctly parse GSSAPI KEX algorithms (bsc#961368)\n- more verbose FIPS mode/CC related documentation in README.FIPS\n  (bsc#965576, bsc#960414)\n- fix PRNG re-seeding (bsc#960414, bsc#729190)\n- Allow empty Match blocks (bsc#961494)\n","status":"published","published":"2016-10-17T14:52:50Z","modified":"2026-02-04T03:21:28.414151Z","references":[{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162555-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/729190","tags":["report"]},{"url":"https://bugzilla.suse.com/932483","tags":["report"]},{"url":"https://bugzilla.suse.com/948902","tags":["report"]},{"url":"https://bugzilla.suse.com/960414","tags":["report"]},{"url":"https://bugzilla.suse.com/961368","tags":["report"]},{"url":"https://bugzilla.suse.com/961494","tags":["report"]},{"url":"https://bugzilla.suse.com/962313","tags":["report"]},{"url":"https://bugzilla.suse.com/965576","tags":["report"]},{"url":"https://bugzilla.suse.com/970632","tags":["report"]},{"url":"https://bugzilla.suse.com/975865","tags":["report"]},{"url":"https://bugzilla.suse.com/981654","tags":["report"]},{"url":"https://bugzilla.suse.com/989363","tags":["report"]},{"url":"https://bugzilla.suse.com/992533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6515","tags":["web"]}],"updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-2966-1","title":"openssh vulnerabilities","description":"Shayan Sadigh discovered that OpenSSH incorrectly handled environment files\nwhen the UseLogin feature is enabled. A local attacker could use this issue\nto gain privileges. (CVE-2015-8325)\n\nBen Hawkes discovered that OpenSSH incorrectly handled certain network\ntraffic. A remote attacker could possibly use this issue to cause OpenSSH\nto crash, resulting in a denial of service. This issue only applied to\nUbuntu 15.10. (CVE-2016-1907)\n\nThomas Hoger discovered that OpenSSH incorrectly handled untrusted X11\nforwarding when the SECURITY extension is disabled. A connection configured\nas being untrusted could get switched to trusted in certain scenarios,\ncontrary to expectations. (CVE-2016-1908)\n\nIt was discovered that OpenSSH incorrectly handled certain X11 forwarding\ndata. A remote authenticated attacker could possibly use this issue to\nbypass certain intended command restrictions. (CVE-2016-3115)\n","status":"published","published":"2016-05-09T17:04:33Z","modified":"2026-06-01T07:15:21.570321719Z","references":[{"url":"https://ubuntu.com/security/notices/USN-2966-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3115","tags":["report"]}],"updated_at":"2026-11-02T16:58:10.303275Z"}]}}