CVE-2016-7406

Published: Mar 3, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Affected (1)

Products: Dropbear Ssh Project: Dropbear Ssh

Dropbear Ssh Project

1 product

Dropbear Ssh

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dropbear Ssh Project Dropbear Ssh	Up to 2016.73

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (11)

http://www.openwall.com/lists/oss-security/2016/09/15/2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/92974

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1376353

Source: cve@mitre.org

Issue Tracking

https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201702-23

Source: cve@mitre.org

PatchThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2024/Aug/35