VDB
CVE-2016-7406
CVE-2016-7406
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
EPSS 10.22% · 95.5th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
10.22%
95.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | dropbear | 2015.68-1, 2015.70-1, 2015.71-1 |
Timeline
- Mar 3, 2017 CVE Published
- Feb 4, 2022 EPSS Score
- May 8, 2023 EPSS Score
- Mar 19, 2025 EPSS Score
- Mar 22, 2025 EPSS Score
- Mar 25, 2025 EPSS Score
- Mar 28, 2025 EPSS Score
- Mar 30, 2025 EPSS Score
- Apr 4, 2025 EPSS Score
- Apr 8, 2025 EPSS Score
- Apr 10, 2025 EPSS Score
- Apr 17, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2016-7406 third-party-advisory
- https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb third-party-advisory
- http://www.openwall.com/lists/oss-security/2016/09/14/7 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-7406 third-party-advisory