2017-09-08
ALT-BU-2017-3337-1
Branch c7 update bulletin.
Closed vulnerabilities
Published: 2017-01-05
BDU:2017-00351
Уязвимость средства криптографической защиты OpenSSH, позволяющая нарушителю получить доступ к защищаемой информации
Severity: LOW (2.1)
References:
Published: 2016-11-24
BDU:2017-00353
Уязвимость агента ssh-agent средства криптографической защиты OpenSSH, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (7.3)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References:
Published: 2017-01-04
BDU:2021-03293
Уязвимость компонента authfile.c службы sshd средства криптографической защиты OpenSSH, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: MEDIUM (5.5)
Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References:
Published: 2015-08-11
BDU:2021-03294
Уязвимость службы sshd средства криптографической защиты OpenSSH, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (8.4)
Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2017-01-05
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-10009
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
Severity: HIGH (7.3)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References:
- http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html
- http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html
- http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
- 20230719 CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
- 20230719 CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
- [oss-security] 20161219 Announce: OpenSSH 7.4 released
- [oss-security] 20161219 Announce: OpenSSH 7.4 released
- [oss-security] 20230719 CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
- [oss-security] 20230719 CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
- [oss-security] 20230719 Re: CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
- [oss-security] 20230719 Re: CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
- 94968
- 94968
- 1037490
- 1037490
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
- RHSA-2017:2029
- RHSA-2017:2029
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1009
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1009
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5
- https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
- FreeBSD-SA-17:01
- FreeBSD-SA-17:01
- https://security.netapp.com/advisory/ntap-20171130-0002/
- https://security.netapp.com/advisory/ntap-20171130-0002/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
- USN-3538-1
- USN-3538-1
- 40963
- 40963
- https://www.openssh.com/txt/release-7.4
- https://www.openssh.com/txt/release-7.4
Published: 2017-01-05
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-10011
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
Severity: MEDIUM (5.5)
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References:
- [oss-security] 20161219 Announce: OpenSSH 7.4 released
- [oss-security] 20161219 Announce: OpenSSH 7.4 released
- 94977
- 94977
- 1037490
- 1037490
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
- RHSA-2017:2029
- RHSA-2017:2029
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf
- https://github.com/openbsd/src/commit/ac8147a06ed2e2403fb6b9a0c03e618a9333c0e9
- https://github.com/openbsd/src/commit/ac8147a06ed2e2403fb6b9a0c03e618a9333c0e9
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
- https://security.netapp.com/advisory/ntap-20171130-0002/
- https://security.netapp.com/advisory/ntap-20171130-0002/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
- https://www.openssh.com/txt/release-7.4
- https://www.openssh.com/txt/release-7.4