What’s Vulnerable › Vulnerabilities

CVE-2016-0778

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 20.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-01-14 · updated 2026-06-17
• Weakness: CWE-119

Description

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

Affected products

• macOS: from 10.9.0 through 10.9.5; from 10.10.0 through 10.10.5; from 10.11.0 through 10.11.3
• HP Virtual Customer Access System: through 15.07
• OpenSSH: 5.4, 5.4-p1, 5.5, 5.5-p1, 5.6, 5.6-p1 (+31)
• Oracle Corporation Oracle Linux: 7
• Oracle Corporation Solaris Operating System: 11.3
• Sophos Unified Threat Management Software: 9.353

References

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html
• http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html
• http://seclists.org/fulldisclosure/2016/Jan/44

Get alerted when CVE-2016-0778 or the next vulnerability affects your stack