CVE-2017-15906: debian debian_linux
Vulnerability summary
CVE-2017-15906 is a medium (CVSS 5.3) vulnerability in debian debian_linux. EPSS estimates a 3.36% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 26-10-2017PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
CVSS metrics
8 scores · 6 sources · 3 versions- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
3.36%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat16 products
- enterprise_linux_desktop7.0
- enterprise_linux_eus7.6 | 7.7
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.6 | 7.7
- enterprise_linux_server_tus7.6 | 7.7
Netapp12 products
Debian2 products
- openssh< 1:7.6p1-1
- debian_linuxEOL8.0
Alpine1 product
- openssh< 7.5_p1-r8 | < 7.2_p1-r2 | < 7.4_p1-r1 | < 7.5_p1-r2 | < 7.5_p1-r0
Mageia1 product
- openssh< 7.5p1-2.1.mga6
Openbsd1 product
- openssh< 7.6
Oracle1 product
Ubuntu1 product
- openssh< 1:6.6p1-2ubuntu2.10 | < 1:7.2p2-4ubuntu2.4 | < 1:7.6p1-4
8 vendors · 35 products
References
32 links- github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19Third Party Advisory
- security.netapp.com/advisory/ntap-20180423-0004/Third Party Advisory
- www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
