CVE-2016-3116

Medium · 6.4

CVSS

6.4

EPSS

19.3%

Published

Mar 22, 2016

CISA due date

—

The record

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

Affected packages

Ecosystem	Package	Fixed
Debian:11	dropbear	2016.72-1
Debian:12	dropbear	2016.72-1
Debian:13	dropbear	2016.72-1
Mageia:5	dropbear	2014.66-1.1.mga5

Related vulnerabilities

CVE-2016-7406 Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to… Also affects dropbear
CVE-2006-1206 Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and… Also affects dropbear