CVE search · CVE-2016-7406
CVE-2016-7406
critical 9.8
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-20
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.0 | critical 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | high 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- dropbear_ssh_project · dropbear_ssh
References
- http://www.openwall.com/lists/oss-security/2016/09/15/2Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/92974Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353Issue Tracking
- https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcbIssue TrackingPatchThird Party Advisory
- https://security.gentoo.org/glsa/201702-23PatchThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2024/Aug/35
- http://www.openwall.com/lists/oss-security/2016/09/15/2Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/92974Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353Issue Tracking
- https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcbIssue TrackingPatchThird Party Advisory
- https://security.gentoo.org/glsa/201702-23PatchThird Party AdvisoryVDB Entry