CVE-2016-0778
- State
- Published
- Severity
- 8.1 High
- Published
- Jan 14, 2016
- Updated
- May 29, 2026
- Reserved
- Dec 16, 2015
Description
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/
- SUSE-SU-2016:0117vendor-advisory
- https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/
- APPLE-SA-2016-03-21-5vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375
- 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778mailing-list
- https://support.apple.com/HT206167
- FEDORA-2016-4556904561vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.openssh.com/txt/release-7.1p2
- openSUSE-SU-2016:0128vendor-advisory
- 80698vdb-entry
- FEDORA-2016-2e89eba0c1vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa109
- 1034671vdb-entry
- openSUSE-SU-2016:0127vendor-advisory
- GLSA-201601-01vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- [oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778mailing-list
- 20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778mailing-list
- SUSE-SU-2016:0119vendor-advisory
- http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html
- SUSE-SU-2016:0118vendor-advisory
- SUSE-SU-2016:0120vendor-advisory
- USN-2869-1vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- DSA-3446vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.