CVE-2016-3115
Fixed in a distro release EPSS 36%CVSS 6.4
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
Products: openbsd openssh, oracle vm_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openssh | 1:7.2p2-1 |
| Debian 13 | openssh | 1:7.2p2-1 |
| Debian 14 | openssh | 1:7.2p2-1 |
| Debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| Red Hat Enterprise Linux 6 | openssh | 0:5.3p1-114.el6_7 |
| Red Hat Enterprise Linux 6 | openssh-askpass | 0:5.3p1-114.el6_7 |
| Red Hat Enterprise Linux 6 | openssh-clients | 0:5.3p1-114.el6_7 |
| Red Hat Enterprise Linux 6 | openssh-debuginfo | 0:5.3p1-114.el6_7 |
| Red Hat Enterprise Linux 6 | openssh-ldap | 0:5.3p1-114.el6_7 |
| Red Hat Enterprise Linux 6 | openssh-server | 0:5.3p1-114.el6_7 |
| Red Hat Enterprise Linux 6 | pam_ssh_agent_auth | 0:0.9.3-114.el6_7 |
| Red Hat Enterprise Linux 7 | openssh | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | openssh-askpass | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | openssh-clients | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | openssh-debuginfo | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | openssh-keycat | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | openssh-ldap | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | openssh-server | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | openssh-server-sysvinit | 0:6.6.1p1-25.el7_2 |
| Red Hat Enterprise Linux 7 | pam_ssh_agent_auth | 0:0.9.3-9.25.el7_2 |
| SUSE Linux Enterprise Desktop 12 | openssh | 6.6p1-42.1 |
| SUSE Linux Enterprise Desktop 12 | openssh-askpass-gnome | 6.6p1-42.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | openssh | 6.6p1-42.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | openssh-askpass-gnome | 6.6p1-42.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssh | 6.2p2-0.33.2 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssh-askpass-gnome | 6.2p2-0.33.5 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | openssh | 6.2p2-0.33.2 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | openssh-askpass-gnome | 6.2p2-0.33.5 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | openssh | 6.2p2-0.33.2 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | openssh-askpass-gnome | 6.2p2-0.33.5 |
| SUSE Linux Enterprise Server 11 SP4 | openssh | 6.6p1-21.1 |
| SUSE Linux Enterprise Server 11 SP4 | openssh-askpass-gnome | 6.6p1-21.3 |
| SUSE Linux Enterprise Server 11-SECURITY | openssh-openssl1 | 6.6p1-15.1 |
| SUSE Linux Enterprise Server 12 | openssh | 6.6p1-42.1 |
| SUSE Linux Enterprise Server 12 | openssh-askpass-gnome | 6.6p1-42.1 |
| SUSE Linux Enterprise Server 12 SP1 | openssh | 6.6p1-42.1 |
| SUSE Linux Enterprise Server 12 SP1 | openssh-askpass-gnome | 6.6p1-42.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | openssh | 6.6p1-21.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | openssh-askpass-gnome | 6.6p1-21.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openssh | 6.6p1-42.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openssh-askpass-gnome | 6.6p1-42.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | openssh | 6.6p1-42.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | openssh-askpass-gnome | 6.6p1-42.1 |
| SUSE Manager 2.1 | openssh | 6.2p2-0.33.2 |
| SUSE Manager 2.1 | openssh-askpass-gnome | 6.2p2-0.33.5 |
| SUSE Manager Proxy 2.1 | openssh | 6.2p2-0.33.2 |
| SUSE Manager Proxy 2.1 | openssh-askpass-gnome | 6.2p2-0.33.5 |
| SUSE OpenStack Cloud 5 | openssh | 6.2p2-0.33.2 |
| SUSE OpenStack Cloud 5 | openssh-askpass-gnome | 6.2p2-0.33.5 |
| Ubuntu 14.04 LTS | openssh | 1:6.6p1-2ubuntu2.7 |