56 matches found
CLSA-2026-1777547626 openssh: Fix of CVE-2026-35385
CVE-2026-35385: clear setuid/setgid bits when downloading files as root in scp legacy -O mode without the -p flag...
CLSA-2026-1777546896 openssh: Fix of CVE-2026-35385
CVE-2026-35385: when downloading files as root in legacy -O mode and without the -p preserve modes flag, scp1 did not clear setuid/setgid bits from downloaded files. Backport upstream commit 487e8ac1 to mask out the setuid/setgid bits in this case...
Amazon Linux 2 : openssh, --advisory ALAS2-2026-3262 (ALAS-2026-3262)
The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3262 advisory. In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectation...
Important: openssh
Issue Overview: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode. CVE-2026-35385 Affected Packages: openssh Issue...
Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2026-1604)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1604 advisory. In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and...
CLSA-2026-1777479123 openssh: Fix of CVE-2026-35385
CVE-2026-35385: scp legacy -O mode privilege escalation via umask bypass...
Photon OS 4.0: Openssh PHSA-2026-4.0-1002
An update of the openssh package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-1002. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
ROOT-OS-DEBIAN-11-CVE-2026-35385 CVE-2026-35385 in rootio-openssh - Patched by Root
Root has patched CVE-2026-35385 in the rootio-openssh package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-35385 CVE-2026-35385 in rootio-openssh - Patched by Root
Root has patched CVE-2026-35385 in the rootio-openssh package for Root:Debian:13. Multiple fixed versions available...
CVE-2026-35385
...
Linux Distros Unpatched Vulnerability : CVE-2026-35385
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performe...
CVE-2026-35385
creationtimestamp| type| source ---|---|--- 2026-04-02 17:18:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116336249196256275 2026-04-02 18:09:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijsgdr42e2t 2026-04-02 18:24:22+00:00| seen|...
CVE-2026-35385
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode...
CVE-2026-35385
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode...
MAL-2025-35385 Malicious code in test-mlw2-gales-narre (npm)
The package test-mlw2-gales-narre was found to contain malicious code...
CVE-2024-35385
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjsmkffisig function in the mjs.c file...
CVE-2024-35385
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjsmkffisig function in the mjs.c file...
CVE-2024-35385
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjsmkffisig function in the mjs.c file...
