CVE-2016-7406
Critical · 9.8CVSS
9.8
EPSS
10.2%
Published
Mar 3, 2017
CISA due date
—
The record
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | dropbear | 0 | 2016.74-1 |
| Debian:12 | dropbear | 0 | 2016.74-1 |
| Debian:13 | dropbear | 0 | 2016.74-1 |
| Debian:7 | dropbear | 0 | 2012.55-1.3+deb7u1 |
| Mageia:5 | dropbear | 0 | 2014.66-1.2.mga5 |
| Ubuntu:16.04:LTS | dropbear | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | dropbear | 0 | No fix |
Related vulnerabilities
- CVE-2016-3116 CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated… Also affects dropbear
- CVE-2006-1206 Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and… Also affects dropbear
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20
- CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate… CWE-20
- CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with a fast… CWE-20