What’s Vulnerable › Vulnerabilities

CVE-2016-4422

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-05-06 · updated 2026-06-17
• Weakness: CWE-287

Description

The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.

Affected products

• Debian Linux: 8.0
• Libpam-Sshauth Project Libpam-Sshauth: all versions

References

• http://www.debian.org/security/2016/dsa-3567
• https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/114#src/pam_sshauth.c
• http://www.debian.org/security/2016/dsa-3567
• https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/114#src/pam_sshauth.c

Get alerted when CVE-2016-4422 or the next vulnerability affects your stack