CVE-2015-5352: openbsd openssh
Vulnerability summary
CVE-2015-5352 is a medium (CVSS 4.3) vulnerability in openbsd openssh. EPSS estimates a 4.52% chance of exploitation in the next 30 days, higher than 91.5% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 5Timeline
- 03-08-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.52%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
Decrease -0.93 pp
From 5.45% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Mageia2 products
- openssh< 6.2p2-3.3.mga4
- openssh< 6.6p1-5.1.mga5
Debian1 product
- openssh< 1:6.9p1-1
Openbsd1 product
- openssh≤ 6.8
Ubuntu1 product
- openssh< 1:6.6p1-2ubuntu2.2
4 vendors · 5 products
References
23 links- www.ubuntu.com/usn/USN-2710-2Vendor Advisory
- security.gentoo.org/glsa/201512-04Vendor Advisory
- rhn.redhat.com/errata/RHSA-2016-0741.htmlVendor Advisory
- www.securityfocus.com/bid/75525VDB Entry
- www.securitytracker.com/id/1032797VDB Entry
Show all 23 references
- www.openssh.com/txt/release-6.9Vendor Advisory
- www.ubuntu.com/usn/USN-2710-1Vendor Advisory