SB2017010503 - Debian update for openssh
Published: January 5, 2017 Updated: November 21, 2018
Security Bulletin ID
SB2017010503
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Buffer overflow (CVE-ID: CVE-2016-10012)
The vulnerability allows a local user to execute arbitrary code on vulnerable system with root privileges.The vulnerability exists in sshd due to a flaw in boundary checks in the shared memory manager that may be skipped by some optimizing compilers. A local user can trigger memory corruption and execute arbitrary code with root privileges. The issue is related to m_zback and m_zlib data structures.
Successful exploitation of this vulnerability may allow a local user to elevate privileges.
Remediation
Install update from vendor's website.