SUSE-SU-2016:1528-1 Security update for openssh

openssh was updated to fix three security issues. These security issues were fixed: - CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to...

IBM TRIRIGA Application Platform HTTP Request Forwarding Vulnerability

The IBM TRIRIGA Application Platform is a set of technology platforms for deploying TRIRIGA applications from IBM in the United States. The platform provides a set of design-time and run-time components for building and running its enterprise applications, respectively, and supports...

SOL71960814 - OpenSSH vulnerability CVE-2016-1908

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

OracleVM 3.3 / 3.4 : openssh (OVMSA-2016-0048)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2016-3115: missing sanitisation of input for X11 forwarding 1317817 - Restore functionallity of pamsshagentauth in FIPS mode 1278315 - Initialize devicesdone variable for challenge response 128146...

Oracle Linux 6 : openssh (ELSA-2016-0741)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0741 advisory. - CVE-2016-3115: missing sanitisation of input for X11 forwarding 1317817 Tenable has extracted the preceding description block directly from the Oracl...

openssh security, bug fix, and enhancement update

5.3p1-117 - CVE-2016-3115: missing sanitisation of input for X11 forwarding 1317817 5.3p1-116 - Restore functionallity of pamsshagentauth in FIPS mode 1278315 - Initialize devicesdone variable for challenge response 1281468 - Update behaviour of X11 forwarding to match upstream 1299048 5.3p1-115 ...

RHEL 6 : openssh (RHSA-2016:0741)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0741 advisory. - openssh: XSECURITY restrictions bypass under certain conditions in ssh1 CVE-2015-5352 - openssh: Privilege separation weakness related to...

openssh: possible fallback from untrusted to trusted X11 forwarding

An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, eve...

Moderate: Red Hat Security Advisory: openssh security, bug fix, and enhancement update

An update for openssh is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

openssh: XSECURITY restrictions bypass under certain conditions in ssh(1)

It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested...

BSA-2016-019

Security Advisory ID : BSA-2016-019 Component : OpenSSH Revision : 3.0: Final Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the 1...

USN-2966-1 openssh vulnerabilities

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. CVE-2015-8325 Ben Hawkes discovered that OpenSSH incorrectly handled certain network traffic. A remote attacker could possibl...

USN-2966-1: OpenSSH vulnerabilities

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. CVE-2015-8325 Ben Hawkes discovered that OpenSSH incorrectly handled certain network traffic. A remote attacker could possibl...

AIX OpenSSH Advisory : openssh_advisory8.asc

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities : - A remote code execution vulnerability exists in the sshd server component of OpenSSH due to improper sanitization of X11 authentication credentials. An authenticated, remote attacker can...

openssh security update

4.3p2-82.0.2 - CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices John Haxby orabug 22985024 - CVE-2016-3115: missing sanitisation of input for X11 forwarding John Haxby orabug 22985024...

DHL Global Forwarding Track - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application DHL Global Forwarding Track published at the 'play' market has multiple vulnerabilities...

Amazon Linux AMI : openssh (ALAS-2016-675)

An access flaw was discovered in the OpenSSH client where it did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, eve...

openSUSE Security Update : dropbear (openSUSE-2016-387)

dropbear was updated to 2016.72 to fix the following issues : Changes in dropbear : - updated to upstream version 2016.72 - Validate X11 forwarding input. Could allow bypass of authorizedkeys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug...

openSUSE Security Update : dropbear (openSUSE-2016-393)

This update for dropbear fixes the following issues : - dropbear was updated to upstream version 2016.72 - Validate X11 forwarding input. Could allow bypass of authorizedkeys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug fix release for...

Fedora 23 : dropbear-2016.72-1.fc23 (2016-332491de28)

CVE-2016-3116 dropbear: X11 forwarding input not validated properly Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...