CVE-2016-7406

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/09/15/2Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/92974Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1376353Issue Tracking
https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcbIssue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201702-23Patch, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2024/Aug/35
http://www.openwall.com/lists/oss-security/2016/09/15/2Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/92974Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1376353Issue Tracking
https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcbIssue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201702-23Patch, Third Party Advisory, VDB Entry

Timeline

Published: Mar 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-74079.8The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.CVE-2016-74088.8The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.CVE-2016-74095.5The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v CVE-2016-74105.5The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) vi CVE-2016-74119.8ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a d CVE-2016-74128.1ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, w CVE-2016-74139.8Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote CVE-2016-74149.8The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is la CVE-2016-74159.8Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ all CVE-2016-74167.5ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to th CVE-2016-74179.8ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and CVE-2016-74187.5The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial o