CVE-2016-3115: openbsd openssh
Vulnerability summary
CVE-2016-3115 is a medium (CVSS 6.4) vulnerability in openbsd openssh. EPSS estimates a 35.53% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 5Timeline
- 22-03-2016PublishedVulnerability first disclosed.
- 29-05-2026Last modifiedVulnerability information updated.
Description
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
CVSS metrics
7 scores · 4 sources · 3 versions- NVDNIST6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
35.53%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
Decrease -1.49 pp
From 37.02% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOpenSSH 7.2p1 - (Authenticated) xauth Command Injection
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- openssh< 1:7.2p2-1
Mageia1 product
- openssh< 6.6p1-5.7.mga5
Openbsd1 product
- openssh≤ 7.2
Oracle1 product
- vm_server3.2
Ubuntu1 product
- openssh< 1:6.6p1-2ubuntu2.7
5 vendors · 5 products
References
33 links- www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlX Refsource CONFIRMVendor Advisory
- github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115X Refsource MISC
- www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlX Refsource CONFIRM
- cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.cX Refsource CONFIRM
Show all 33 references
- lists.fedoraproject.org/pipermail/package-announce/2016-April/183101.htmlVendor AdvisoryX Refsource FEDORA
- www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2016-March/180491.htmlVendor AdvisoryX Refsource FEDORA
- bto.bluecoat.com/security-advisory/sa121X Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2016-March/179924.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2016-May/184264.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2016-April/183122.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2016-March/178838.htmlVendor AdvisoryX Refsource FEDORA