CVE-2016-3116 Other in n/a

What is CVE-2016-3116?

CVE-2016-3116 is a medium-severity vulnerability in n/a, published on 22 Mar 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

Which versions are affected by CVE-2016-3116?

It affects 1 product.

Products include Dropbear Ssh Project Dropbear Ssh.

How do I fix CVE-2016-3116?

Upgrade to a fixed version.

Is CVE-2016-3116 being exploited?

There is no known exploitation of CVE-2016-3116 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2016-7406 Code injection in n/a Critical 9.8
• CVE-2016-7407 Code injection in n/a Critical 9.8
• CVE-2016-7408 Command injection in n/a High 8.8
• CVE-2020-36254 Path traversal in n/a High 8.1
• CVE-2007-1099 Security feature bypass in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-3116, GHSA-qrcr-w7v9-jxvw, MGASA-2016-0113.