CVE Feed

Dashboard / CVE / CVE-2016-0778

CVE-2016-0778

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

Published:Jan 14, 2016

Last Modified:May 29, 2026

EPS:Jan 14, 2016

EPSS Score:0.00914

CVSS Score:8.1

Affected Products

Vendor

Product

Action

Vendor

Apple

Product

Mac Os X

Apple

Mac Os X

Vendor

Hp

Product

Virtual Customer Access System

Hp

Virtual Customer Access System

Vendor

Openbsd

Product

Openssh

Openbsd

Openssh

Vendor

Oracle

Product

Linux

Oracle

Linux

Vendor

Oracle

Product

Solaris

Oracle

Solaris

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Sophos

Product

Unified Threat Management Software

Sophos

Unified Threat Management Software

Exploits

http://www.openwall.com/lists/oss-security/2016/01/14/7 http://www.openwall.com/lists/oss-security/2016/01/14/7

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-122 Heap-based Buffer Overflow

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

CAPEC-92 Forced Integer Overflow

Related CVEs

CVE-2024-41868 (CVSS 5.5) — Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds read vulnerability that could le…

CVE-2024-39378 (CVSS 7.8) — Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could r…

CVE-2021-3187 (CVSS 8.8) — An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged…

CVE-2023-34045 (CVSS 6.6) — VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during inst…

CVE-2023-34046 (CVSS 6.7) — VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs dur…

CVE-2023-34044 (CVSS 7.1) — VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerab…

CVE-2022-46706 (CVSS 7.8) — A type confusion issue was addressed with improved state handling. This issue is fixed in Security Update 2022…

CVE-2022-22630 (CVSS 9.8) — A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.…

CVE-2023-1763 (CVSS 6.5) — Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and…

CVE-2023-1764 (CVSS 6.5) — Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and…

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734

http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html

http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html

http://seclists.org/fulldisclosure/2016/Jan/44

http://www.debian.org/security/2016/dsa-3446

http://www.openssh.com/txt/release-7.1p2

http://www.openwall.com/lists/oss-security/2016/01/14/7

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.securityfocus.com/archive/1/537295/100/0/threaded

http://www.securityfocus.com/bid/80698

http://www.securitytracker.com/id/1034671

http://www.ubuntu.com/usn/USN-2869-1

https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/

https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/

https://bto.bluecoat.com/security-advisory/sa109

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

https://security.gentoo.org/glsa/201601-01

https://support.apple.com/HT206167

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734

http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html

http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html

http://seclists.org/fulldisclosure/2016/Jan/44

http://www.debian.org/security/2016/dsa-3446

http://www.openssh.com/txt/release-7.1p2

http://www.openwall.com/lists/oss-security/2016/01/14/7

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.securityfocus.com/archive/1/537295/100/0/threaded

http://www.securityfocus.com/bid/80698

http://www.securitytracker.com/id/1034671

http://www.ubuntu.com/usn/USN-2869-1

https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/

https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/

https://bto.bluecoat.com/security-advisory/sa109

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

https://security.gentoo.org/glsa/201601-01

https://support.apple.com/HT206167

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High