MGASA-2016-0022

Source
https://advisories.mageia.org/MGASA-2016-0022.html
Import Source
https://advisories.mageia.org/MGASA-2016-0022.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2016-0022
Related
Published
2016-01-15T19:43:58Z
Modified
2016-01-15T19:39:39Z
Summary
Updated openssh packages fix security vulnerabilities
Details

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory (possibly including private SSH keys) of a successfully authenticated OpenSSH client (CVE-2016-0777).

A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options (CVE-2016-0778).

The issue only affects OpenSSH clients making use of the ProxyCommand feature. This update disables the roaming feature completely.

References
Credits

Affected packages

Mageia:5 / openssh

Package

Name
openssh
Purl
pkg:rpm/mageia/openssh?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6p1-5.6.mga5

Ecosystem specific

{
    "section": "core"
}