CVE-2016-1908

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-1908
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-1908.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-1908
Downstream
DEBIAN (1)
RHSA (2)
SUSE (4)
UBUNTU (1)
Related
SUSE (4)
Published
2017-04-11T18:59:00Z
Modified
2026-10-06T02:17:27Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpe": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "fixed": "7.2"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "cpe": "cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7-NA"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.2"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.2"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.2"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/openssh/openssh-portable

Affected ranges

Type
GIT
Repo
https://github.com/openssh/openssh-portable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
fd0fa130ecf06d7d092932adcd5d77f1549bfc8d
Last Affected
25e4256ad4f453d8a7c1866243ec1984f859b1de
Last Affected
d5dacb43fa30c2f6d7eebbd4c5fcf906c3b5d5d8
Last Affected
1dc8d93ce69d6565747eb44446ed117187621b26
Last Affected
99522ba7ec6963a05c04a156bf20e3ba3605987c
Last Affected
4a354fc231174901f2629437c2a6e924a2dd6772
Last Affected
d38f05dbdd291212bc95ea80648b72b7177e9f4e
Last Affected
66bf74a92131b7effe49fb0eefe5225151869dc5
Last Affected
a0349a1cc4a18967ad1dbff5389bcdf9da098814
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
        "cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        },
        {
            "last_affected": "6-NA"
        },
        {
            "last_affected": "6.0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "last_affected": "7.3"
        },
        {
            "last_affected": "7.4"
        },
        {
            "last_affected": "7.5"
        },
        {
            "last_affected": "7.6"
        },
        {
            "last_affected": "7.7"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

Other
PRE_DAN_PATCH_MERGE
PRE_FIXPATHS_INTEGRATION
PRE_HPUX_INTEGRATION
PRE_IPV6
V_1_2PRE17
V_1_2_1_PRE18
V_1_2_1_PRE19
V_1_2_1_PRE20
V_1_2_1_PRE21
V_1_2_1_PRE22
V_1_2_1_PRE23
V_1_2_1_PRE24
V_1_2_1_PRE25
V_1_2_PRE10
V_1_2_PRE11
V_1_2_PRE12
V_1_2_PRE13
V_1_2_PRE14
V_1_2_PRE15
V_1_2_PRE16
V_1_2_PRE4
V_1_2_PRE5
V_1_2_PRE6
V_1_2_PRE7
V_1_2_PRE8
V_1_2_PRE9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-1908.json"